They're at it again! Phony emails bearing the BBB name are bombarding in-boxes across the country and right here in Southeast Texas. The recent attack on consumers and businesses led the FBI to issue an alert this week about the recurrent scam.
Like many financial institutions and government agencies, BBB's visibility and reputation for trust makes us an ideal vehicle for scammers. Consider that bbb.org receives over six million visits every month; this makes us an attractive decoy for fraud and malicious activity.
We recommend that all domain owners set up a sender policy framework (SPF) and set their spam filter to use it. “Using the SPF standard helps fight spam and phishing attacks by allowing your email servers to verify whether an email is legitimate.
Microsoft offers a simple, four-step process for setting up an SPF:www.microsoft.com/mscorp/safety/content/technologies/senderid/wizard/.
There is one authentic BBB email address that should be whitelisted:
If you receive an email saying that your business has a complaint filed against it with BBB, there are several things you can do to authenticate it:
- Look for typos, grammatical errors, etc. in the text that could indicate it originated overseas.
- Check to see who it says it is from. Complaints go out from the local BBBs, not from the headquarters office. If you "whitelisted" the address above, this may eliminate your problems.
- Hover your mouse over the link to see if its destination is really a bbb.org address.
- Copy and paste the link into Notepad (not Word). Notepad does not support html, so if the link is a fake bbb.org address, the real link will show up.
Note - an authentic email from BBB will always:
- come from your local BBB - not the Council of Better Business Bureaus or a BBB from another state.
- the from email address is xx@bbbsetexas.org. The "xx" will be replaced with ‘complaints’ or your BBB complaint contact person's name, which is either Jay Sheppard or Ivy Cobb.
- the email will include a secure HTTPS link to the complaint details.
- complaints are never sent as attachments.
The BBB system is working with federal law enforcement agencies to identify the perpetrator(s) of this fraud and has retained a deactivation company to help with those efforts.