Interac eTransfer Fraud phishing Alert
Interac eTransfers are fraud and scams when the etrasnsfer is emailed from any name that when clicking the name shows as "support@sparkpostbox.com" and/or the "Deposit your Money" link goes to "go.sparkpostmail1.com" which then redirects to https://pros-t.000webhostapp.comfff/pros-one.html
The potential guest sent the email below from a generic gmail: pk0013109@gmail.com
"Hello, My spouse and I are looking to stay at your accommodation when we visit the area. We want to know your available dates from March 15th to April 30th. Thanks."
I have not identified the name of the person as I suspect its a real person who's identifty has been stolen.
After several simpe emails back and forth concerning dates, options and prices I gave them a direct booking link to which they replied choosing the most expensive option,
"Ok. We will go for breakfast. We want to book and pay via etransfer. Send me your etransfer email. Also suggest what i should use as a security question and answer for the transfer."
After sending them the etransfer info they had requested, along with a request for their contact phone number and address this reply came which made me suspicious,
"We have had issues sending out etransfers to gmail addresses in the past. Please provide another email for etransfer.
(250) 923-1899"
I've redacted the Campbell River address they gave as it might be the real address of the person who's identiy might have been stolen.
I gave them another email and the following day an etransfer for just under $2,000 was received. It had the person's name as the sender, however, when clicking the name it showed it was sent from, "support@sparkpostbox.com"
Real Canadian interac etransfers come from "notify@payments.interac.ca"
Holding the mouse down over the yellowish "Deposit your Money" bar without releasing it showed a long url that included, "go.sparkpostmail1.com" as part of the URL
When using my phone and actually clicking the link it took me to the regular looking web page where you select your financial institution, however, the url was https://pros-t.000webhostapp.comfff/pros-one.html when it should have gone to https://etransfer.interac.ca
I then called the phone number they had supplied and it went straight to, "sorry this customer is presently not available" and no voicemail. My call history also placed that phone number in Central kootenay and not Campbell River.
If I had entered my banking login credentials they would have had my username and login to my bank account.
If you receive such an Interac e-Transfer text or email you weren't expecting, confirm with the sender via another channel such as a phone call, or you suspect it to be fraudulent, don't respond or click any links. Forward the email right away to phishing@interac.ca.
