Be a Mule? Don’t Be an Ass

This is quite a neat example of mule spam, or at least I think it is. A mule is someone who is lured, willingly or unwittingly, into moving money around for scamsters — often, but not always, phishers. Scamsters, you see, may be able to empty your bank account, but not always into an account in a different country, so unless they happen to live in the same place as you, they need someone else to move money from one place to another.

So they hire a mule, who takes money into their account — the emptying bit — and then send it overseas, keeping a percentage for themselves. Quite often they don’t know, or want to know, where the money came from. There’s usually a cover story, of a company that doesn’t yet have an office there to collect outstanding money owed by customers, etc etc.

Anyway, I just got an email that appears to be from USATODAY. It reads:

Based on the career profile you provided us, you might be interested in the following job. To review the job description and if you would like to continue the process, send a blank e-mail with the word “USATODAY” in the subject line to efxjobs@cox.net

1471 — Sr. Financial Representative

All you need is an active bank account, good communication, internet access and desire to work as a big team. Get from 5 to 10% from each transaction! We focuses on serving distant consumers, many of whom seek alternatives to traditional banking relationships in order to gain immediate access to their funds for financial and franchising services.

Then there’s a clever little bit at the bottom, which offers a seemingly legitimate URL to unsubscribe:

If this confirmation notice was sent to you in error or to unsubscribe at any time, please click: http://reg.e.usatoday.com/edit.aspx?8461277203 <http://click.e.usatoday.com/?d00a10-22f06b7c7073e00c67bc-f969ae35ff5bceabf5be55e5>

It is actually a legitimate USAToday unsubscribe page, but, unless you happen to be a subscriber to their mailing list, it will throw up an error message.

The smart element here is that there’s really nothing that is dodgy about the e-mail, apart from the fact that you’ve probably not registered at USATODAY.com. But how can you be sure? Maybe it was a few years ago? I seem to recall registering once for some sort of news ticker thing. So you tend to believe that part of it — the social engineering part — at least enough to read the contents.

And who doesn’t want to gte 5 to 10% from each transaction? Don’t be a donkey, though. Phishers are not guys to be messed with. They may not live down the street from you, but they are not people to get involved with.