Subscribe to RSS News Feed
About Spamhaus  |  Press Office  |  FAQs   
UK Tax Office Sends an Invitation to Phishers

2011-09-30 12:45:00 UTC   |   by Quentin Jenkins   |  
Recent News Articles

The return of the ASN-DROP

Qakbot - the takedown and the remediation

Poor sending practices trigger a tidal wave of informational listings

Spamhaus Botnet Threat Update: Q4-2021

SERVICE UPDATE | Spamhaus DNSBL users who query via Cloudflare DNS need to make changes to email set-up

Spamhaus Botnet Threat Update: Q3-2021

Spammer Abuse of Free Google Services

Spamhaus Botnet Threat Update: Q2-2021

Older News Articles:
Spamhaus News INDEX

Phishing. Broadly speaking, sending out emails which misdirect people to supply confidential information to miscreants. One such ruse in the UK has been to send out tax rebate emails purporting to come from the UK tax office, HMRC.

So on Friday, in a stroke of genius, HMRC sent out the following:

To our mind the key error here is supplying links in the email which can be altered behind the scenes to drop the unsuspecting onto malicious websites. While this email doesn't do that, it's setting up the expectation that HMRC will send out emails with inline links which people are expected to click on. If the link has been changed behind the scenes, where will you end up? Certainly not HMRC servers. More likely you'll end up on a site hosted in Russia or the Ukraine that pretends to be the UK's HMRC.

If you're security minded, you can look at the raw email at which point another "error" comes to the fore. The email doesn't actually come from HMRC's servers, it comes from:

Received: from 
(unknown [])
 by [cut] (Postfix) with ESMTP id [cut]
 for < [cut]>; Fri, 30 Sep 2011 12:14:54 +0100 (BST)
 Received: from CCGMSCTD ([]) by with Microsoft SMTPSVC(6.0.3790.4675);

Who are One has to assume they're the ESP ("Email Service Provider") appointed by HMRC to deliver their bulk email. Should one have to make these assumptions when we're talking about something as sensitive as tax?

And then in the final line, HMRC have set up the expectation that a similar email will be sent out in February 2012.

Surely to any self respecting phisher, this is a godsend? A couple of simple changes and you've got a very credible phishing email.

While we do appreciate the difficulties faced by organisations when wishing to communicate with their customer base via email, we'd put this one forward as a text book case as to how not to do it.

Spamhaus Information

Press Office
Spamhaus News Index
Spamhaus in the media
About Spamhaus
Spamhaus Official Statements
Article Information

Permanent link to this news article:
UK Tax Office Sends an Invitation to Phishers

Subscribe to RSS News Feed
Spamhaus News Quotes

Permission to quote from or reproduce Spamhaus News articles is granted automatically providing you state the source as Spamhaus and link to the news record.
© 1998-2023 The Spamhaus Project SLU. All rights reserved.
Legal  |  Privacy