COMCAST / XFINITY SCAM with a NEW TWIST

[Ace-Garageguy]

FAKE EMAILS supposedly from Comcast / Xfinity going out to "account recovery" emails saying "Your automatic payment was declined bla bla bla"

And "your service will be interrupted", but they say "we will temporarily Turned off our service."

Anybody see anything wrong with that?

Then there's the originating email sender: www.pay-box.in

Of course there's the standard "click here, idiot" button to "update your account" that takes you to a spoofed site where they steal your debit card or bank account info.

Well see fellers, I don't do autopay. So that's another red flag.

And of course I'd never click the moron button.

BUT...the new twist is that if you try to go directly to Xfinity from the same browser, they've got some kind of redirect set up that makes the site seem to be inoperative, to try to scare you into going back and clicking the moron button.

DON'T DO IT.

I used another browser on a different ISP to access the real site and there's no problem.

Obviously somebody has hacked Xfinity and has all the "account recovery" emails, so BEWARE.

 

Edited September 18, 2024 by Ace-Garageguy

[bobthehobbyguy]

I wonder what they are doing to get the redirect. What else did they add to that computer?

[Ace-Garageguy]

1 hour ago, bobthehobbyguy said:

I wonder what they are doing to get the redirect. What else did they add to that computer?

I don't know. IT is not my area of expertise. 

However, after running the most current Windows and Chrome updates, the real site comes up every time now, not the spoofed one.

EDIT: There are several online references to "www.pay-box.in", the origin of the supposed Xfinity email, and it quite obviously has absolutely nothing nada zip zero to do with Xfinity / Comcast...other than being in India, where Xfinity has most of its customer service people.

There are some pretty sophisticated hackers all over the planet these days, so who knows.

 

Edited September 18, 2024 by Ace-Garageguy

[Mike C]

On 9/17/2024 at 11:34 AM, Ace-Garageguy said:

FAKE EMAILS supposedly from Comcast / Xfinity going out to "account recovery" emails saying "Your automatic payment was declined bla bla bla"

And "your service will be interrupted", but they say "we will temporarily Turned off our service."

Anybody see anything wrong with that?

Then there's the originating email sender: www.pay-box.in

Of course there's the standard "click here, idiot" button to "update your account" that takes you to a spoofed site where they steal your debit card or bank account info.

Well see fellers, I don't do autopay. So that's another red flag.

And of course I'd never click the moron button.

BUT...the new twist is that if you try to go directly to Xfinity from the same browser, they've got some kind of redirect set up that makes the site seem to be inoperative, to try to scare you into going back and clicking the moron button.

DON'T DO IT.

I used another browser on a different ISP to access the real site and there's no problem.

Obviously somebody has hacked Xfinity and has all the "account recovery" emails, so BEWARE.

 

I've been getting those for quite a few other accounts. The only problem for the scammers is that I don't have any of those accounts.

[1972coronet]

On 9/17/2024 at 8:34 AM, Ace-Garageguy said:

"we will temporarily Turned off our service."

The tense-shifts alone would make me scoff at their rubbish...

[Ace-Garageguy]

1 hour ago, 1972coronet said:

The tense-shifts alone would make me scoff at their rubbish...

Sad thing is that I'm seeing more and more of this from native English-speakers...including professional "journalists".

Scrambled messes like "he did stopped..." are more and more frequent.

I really have to wonder what kind of "teachers" we have now.

Edited September 24, 2024 by Ace-Garageguy

[peteski]

We're all going to (English language) hell in a handbasket!

I notice all this, even though English is my second language.

Latest  irk of mine is the word "ideate".  Who the hack came up with that one?! Then there is "ask" used instead of "question" or "request".