More Phishing

Posted on 6 March, 2008 by maximinus

Over the past few weeks, I'd received a couple of identical phishing emails, targetting customers of a Canadian bank.  The emails have a spoofed sender address of abuse@<target bank's domain> - and the first couple of times, I just let it go, because I couldn't be bothered reporting it (and I hadn't realised that it was a bank).

Yesterday, I received yet another one.  I decided that since it was still going on, I should report it.  I forwarded the email (as an attachment, to preserve full headers) to abuse@<bank's domain>, with a note explaining what it was.  I then went to bed.

This morning, I checked my email, only to find a failure notice from my mail server, informing me that the bank's mail server had rejected my message:

Remote host said: 550 This message contains a virus
(Phishing.Heuristics.Email.SpoofedDomain)

It's great that their server has detected a phishing email - but how can I report the phish, if their mail server won't accept the message?  I guess I'll just have to give them the full headers and the message content sans-link...