western union -- phishing?

Dave Stones · 24-02-2005, 09:04

received the following email purporting to be from western union today...

Quote:

Originally Posted by dave's email

Dear J GREEN,

Thank you for using the Western Union Money Transfer SM.

In order to provide final approval for your transaction, we need additional information. Please call 0800 731 18 15 between 8:00 am and 8:00 pm daily to speak with a Customer Service Representative and complete your order.

If we do not hear from you in the next 24 hours, we will cancel you money transfer and you will not be billed.

Your Money Transfer Control Number [MTCN] is: 913*4*9*70
stars added by me just in case it's a real number
Please use this number for any inquiries.

If you have any questions, please visit our website at westernunion.co.uk.

Thank you for using Western Union!

------------------------------------------------------------------------------------------------------------------------------
DO NOT REPLY TO THIS EMAIL. IF YOU HAVE QUESTIONS PLEASE CONTACT US.

slightly suspicious, as i am not called J Green and I haven't made a western union transfer. The WU telephone number is 0800 833833 too, so hmmm

the email headers seem legit though, which is confusing me...

Quote:

Originally Posted by Email headers

X-Gmail-Received: 5e12e1c3a34cb709c6f577e700b44303fbe1b233
Delivered-To: ********@gmail.com
Received: by 10.38.207.49 with SMTP id e49cs4361rng;
Wed, 23 Feb 2005 18:02:10 -0800 (PST)
Received: by 10.38.171.35 with SMTP id t35mr172995rne;
Wed, 23 Feb 2005 18:02:09 -0800 (PST)
Return-Path: <westernunionresponse@westernunion.com>
Received: from westernunion.com (mail.westernunion.com [206.201.224.9])
by mx.gmail.com with ESMTP id 57si188467rnc.2005.02.23.18.02.08;
Wed, 23 Feb 2005 18:02:09 -0800 (PST)
Received-SPF: pass (gmail.com: best guess record for domain of westernunionresponse@westernunion.com designates 206.201.224.9 as permitted sender)
Received: from ([172.31.14.54])
by mail.westernunion.com with ESMTP id KP-TRMF3.775001;
Wed, 23 Feb 2005 16:41:42 -0500
Received: from wueml02 ([172.31.18.90])
by mail.westernunion.com (Lotus Domino Release 6.5.2)
with ESMTP id 2005022316414472-500440 ;
Wed, 23 Feb 2005 16:41:44 -0500
Message-ID: <1367499731.1109194563875.JavaMail.wasadmin@wueml0 2>
From: westernunionresponse@westernunion.com
To: ********@GMAIL.COM
Subject: Western Union - PLEASE CALL TO COMPLETE ORDER
Mime-Version: 1.0
X-MIMETrack: Itemize by SMTP Server on SMTP1/WesternUnion(Release 6.5.2|June 01, 2004) at
02/23/2005 04:41:44 PM,
Serialize by Router on SMTP1/WesternUnion(Release 6.5.2|June 01, 2004) at
02/23/2005 04:41:44 PM,
Serialize complete at 02/23/2005 04:41:44 PM
Date: Wed, 23 Feb 2005 16:41:44 -0500
Content-Type: multipart/mixed; boundary=1466524627.1109194563875.JavaMail.wasadmi n.wueml02

i've reported it to western union (not using the contact us link in the email) but just thought i would give a heads up in case...