The scammers & criminals get ever more creative with their phishing scams. This is one I have not seen before and could be very effective.
It pretends to be a message from the UK Student Finance Body checking they have correct details to pay the payments.
If you are unwise enough to follow the links then it will result in your bank, and student identity being stolen
Remember many email clients, especially on a mobile phone or tablet, only show the Name in the From: and not the bit in <domain.com >. That is why these scams and phishes work so well.
From: Student Finance England <email@example.com>
Date: Wed 05/09/2018 06:41
Subject: ABOUT YOUR 2018/19 ACADEMIC SESSION PAYMENTS
2018/19 ACADEMIC SESSION PAYMENTS.
It’s the begining of the new academic year and we will like to ensure that your payments are received promptly.
Kindly follow this link to confirm your remittance details.
Student Finance England
Please don’t reply to this email; it’s been automatically produced from an address that can’t accept incoming mail.
Unsubscribe From this mailing list.
The link in the email is to
which redirects to http://www.softlandingtinz.co/x/ where you see this fake Gov.uk Student Finance page
|188.8.131.52||gsuitmta0.gsuit.icu||Los Angeles||California||US||AS8100 QuadraNet, Inc|
Received: from gsuitmta0.gsuit.icu ([184.108.40.206]:34135) by my mail server with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.91) (envelope-from <firstname.lastname@example.org>) id 1fxQZK-0004Ti-OX for email@example.com; Wed, 05 Sep 2018 06:41:34 +0100 Date: Wed, 5 Sep 2018 00:41:26 -0500 To: firstname.lastname@example.org From: Student Finance England <email@example.com> Reply-To: firstname.lastname@example.org Subject: ABOUT YOUR 2018/19 ACADEMIC SESSION PAYMENTS Message-ID: <email@example.com> List-Unsubscribe: <http://gsuit.icu/mailer/unsubscribe.php?id=PDI3OGE5MWMwMjlmNjA2NjM5YjE5NGYxNzUxMWFmMTM4QGdzdWl0LmljdT4%3D> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="b1_c6f5ad1161056a49167643480f1d732e"