Permanent Links

Poll

What should be the topic for the next Impossibly Stupid poll?

A Town Square Poll Space

Tech Corner

See Also

[ICO]NameLast modifiedSizeDescription

[PARENTDIR]Parent Directory  -  
[TXT]README.html2015-04-03 23:12 12K 
[   ]info.json2014-12-09 01:41 40  
[   ]tags=meta2015-03-26 18:30 0  

Employment Scam: The Dissection

The job situation in America is still pretty bad, and a lot of unscrupulous people run employment scams that make a bad situation even worse for the gullible targets they find. Here is an example of a recent message that came my way:

Return-Path: <affinity.ma@proactmail.com>
X-Original-To: TheUniqueEmailAddress
Received: from 124-93.rs.smtp.com (124-93.rs.smtp.com [74.91.93.124])
by homiemail-mx7.g.dreamhost.com (Postfix) with ESMTP id 913CFCF3B0
for <TheUniqueEmailAddress>; Mon, 21 Jan 2013 07:15:07 -0800 (PST)
X-MSFBL: bWlubmVzb3Rhd29ya3MubmV0QDFxMjAxMy5zdWJzdW1lLmNvbUA3NF85MV85M18x
MjRAcHJvYWN0cmVjcnVpdG1lbnRzX2RlZGljYXRlZF9wb29sQA==
DKIM-Signature: v=1; a=rsa-sha256; d=smtp.com; s=smtpcomcustomers; c=relaxed/simple;
q=dns/txt; i=@smtp.com; t=1358781306;
h=From:Subject:To:Date:MIME-Version:Content-Type;
bh=+BpE3+2xPuv53JLzfXaenJw0MAsmMQRLiEakwDUnI0c=;
b=vo0u7bqzwTU/f2qBoPPo6Bb5AxyU04FJR45G8LVq2hRfC9IyjZ5wVKGlj7XH31jZ
OF7NgzGRICV4UPHiAbTrlQcBpAJHlnJBDuazwpOo/vy6Edij1NwqVV6x+gUWjB51
TBbC6z9xEC/gachIr7rPh63dAC2lFJ/cdkAfe/WOFLA=;
Received: from [173.8.118.229] ([173.8.118.229:4825] helo=proactmail.com)
by rs-ord-mta04.smtp.com (envelope-from <affinity.ma@proactmail.com>)
(ecelerity 3.3.2.44647 r(44647)) with ESMTP
id 97/7C-28209-A7B5DF05; Mon, 21 Jan 2013 15:15:06 +0000
Received: from adama ([192.168.0.6]) by proactmail.com
with SMTP (Code-Crafters Ability Mail Server 2.71);
Mon, 21 Jan 2013 09:15:06 -0600
Thread-Topic: Member Advisor Position
thread-index: Ac336hf6aTVkpTuBQn60y2G+ByO7Og==
From: <affinity.ma@proactmail.com>
To: <TheUniqueEmailAddress>
Subject: Member Advisor Position
Date: Mon, 21 Jan 2013 09:15:06 -0600
Message-ID: <24C710292B774A3D888964EA64AE754C@Metrisource.local>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0190_01CDF7B7.CD605210"
X-Mailer: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.3959
X-SMTPCOM-Tracking-Number: d460876a-94a8-4749-bbf3-a61bf99a3f5b
X-SMTPCOM-Sender-ID: 81499
X-SMTPCOM-Spam-Policy: SMTP.com is a paid relay service. We do not tolerate UCE of any kind. Please report it ASAP to abuse@smtp.com

This is a multi-part message in MIME format.

------=_NextPart_000_0190_01CDF7B7.CD605210
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

Hello Darrin,

My name is Sara Pook, and I work on the Human Resource Team for Affinity
Plus Federal Credit Union. I recently saw your resume on-line and I feel
that your background along with your experience would be a potential fit
for our Member Advisor position that we have available in our Roseville
Branch. Please review the following information below, and if you feel
you are both qualified and interested, follow the directions below to
apply.

As a Member Advisor, we expect you to connect with our members, assist
them with routine banking needs and partner with them through
significant life events. We expect you to build relationships founded on
trust with our members, which includes making decisions that are aligned
with what is right for each individual member, taking ownership of your
own development and delivering a meaningful experience for our members.
Being a Member Advisor at Affinity Plus is a career where you place
people over profits. Our ideal candidates will have to have an intrinsic
drive to connect with people, an enthusiasm to seek creative ways to
make a difference in each member's life and a tenacity to find solutions
that might not be the ones you have tried in the past. Affinity Plus is
a fast-paced and innovative environment that is both challenging and
rewarding.

A career at Affinity Plus is not for the temporary job-seeker, but it IS
for those who are passionate about impacting the lives of others. If
this position sounds like the fulfilling career you are seeking, please
visit us at http://www.affinityplus.org
<http://www.metrisource.com/Ess/ClickThrough.asp?URL=http://www.affinity
plus.org&ID=1019&CID=8132446> and apply online.

We are an organization that celebrates diversity. EOE.

Thank you,

Sara Pook
HR Specialist | Affinity Plus Federal Credit Union
175 W Lafayette Frontage Rd | St. Paul, MN 55107

Go to http://www.metrisource.com/donotsend/ to be added to the Do Not
Send list and enter CODE: 172-8132446 or you may simply reply to this
email with the phrase REMOVE ME in the subject line.

------=_NextPart_000_0190_01CDF7B7.CD605210
Content-Type: text/html
Content-Transfer-Encoding: 7bit

<html><body><font size=2 face=tahoma>Hello Darrin,<br>
<br>

<p>My name is Sara Pook, and I work on the Human Resource Team for Affinity Plus Federal Credit Union. I recently saw your resume on-line and I feel that your background along with your experience would be a potential fit for our Member Advisor position that we have available in our Roseville Branch. Please review the following information below, and if you feel you are both qualified and interested, follow the directions below to apply.</p>

<p>As a Member Advisor, we expect you to connect with our members, assist them with routine banking needs and partner with them through significant life events. We expect you to build relationships founded on trust with our members, which includes making decisions that are aligned with what is right for each individual member, taking ownership of your own development and delivering a meaningful experience for our members. Being a Member Advisor at Affinity Plus is a career where you place people over profits. Our ideal candidates will have to have an intrinsic drive to connect with people, an enthusiasm to seek creative ways to make a difference in each member's life and a tenacity to find solutions that might not be the ones you have tried in the past. Affinity Plus is a fast-paced and innovative environment that is both challenging and rewarding.</p>

<p>A career at Affinity Plus is not for the temporary job-seeker, but it IS for those who are passionate about impacting the lives of others. If this position sounds like the fulfilling career you are seeking, please visit us at <a href="http://www.metrisource.com/Ess/ClickThrough.asp?URL=http://www.affinityplus.org&ID=1019&CID=8132446">http://www.affinityplus.org</a> and apply online.</p>

<p>We are an organization that celebrates diversity. EOE. <br>
<br>
Thank you,<br>
<br>
Sara Pook<br>
HR Specialist | Affinity Plus Federal Credit Union <br>
175 W Lafayette Frontage Rd | St. Paul, MN 55107
</p></font><p></p><p></p><p><font face=Arial size=-2>Go to http://www.metrisource.com/donotsend/ to be added to the Do Not Send list and enter CODE: 172-8132446 or you may simply reply to this email with the phrase REMOVE ME in the subject line.</font></p></body></html>
------=_NextPart_000_0190_01CDF7B7.CD605210--

Now you may get emails like that every day and just let the filters delete them without a second's thought. But I rarely get such messages due to the way I manage my contacts. But even more significant is the fact that the purported employer, Affinity Plus, is actually the credit union I have been a member at for over 20 years! Clearly I had to look into this further.

Is it spam? Check!

The email address used, for which I substituted TheUniqueEmailAddress, is not the one I've given to Affinity Plus for my regular financial business. Rather, it has been harvested from the resume that I had listed on the State of Minnesota's employment site. And at the exact same time I got the above message, I also got 3 other spam in the same vein (e.g., Sale Position at Farmers Insurance). Nothing could more clearly be unsolicted bulk email. Such use of harvested email addresses may even be illegal under the CAN-SPAM Act of 2003.

Is it fraudulent? Check!

Although the link in the body claims to send you to affinityplus.org, it actually sends you to metrisource.com. It is dangerous to click on such a link, or really to click anything in such an untrusted email. Among the things an employment scam might misdirect you to is anything from a drive-by download to install malware on your computer, to more direct phishing attempts that try to get your personal information with the intent of identity theft.

Is it Affinity Plus?

This became the important question. There were a couple possibilities that came to my mind.

Someone is fraudulently claiming to be Affinity Plus

This possibility is the most straightforward. If someone is pretending to be them on the Internet, I am certain Affinity Plus would take action to end it. All I have to do is contact them to let them know it is happening, and they'll take care of the rest.

Affinity Plus is engaged in the fraud themselves

This possibility is the most disturbing. The body of the spam has a person claiming to have read my resume, but anyone who has actually read my resume would see pretty quickly that I am a software architect and developer, which is nothing like the Member Advisor position offered in this spam (or the Sales positions offered in the other spam). But beyond the ethical lapse of that claim, a more disturbing picture is painted: If Affinity Plus HR is the true source of these emails, that means they are intentionally seeking out and hiring employees that have unsafe, insecure habits when it comes to handling electronic communications. That's not reassuring to me as a member and, because their deposits are insured by the NCUA, every taxpayer has to foot the bill when there is a breach in security.

Either way, I decided to ask them if they knew this was going on.

Which was it?

Stay tuned next week for the post where I reveal my findings.

Update: The timeline is now available.