Royal Bank of Canada Phishing Scam

by Alan Yu
2 Comments

I actually thought this was legit at first. Of course, as usual if I am not expecting an e-mail from a person then there is a high chance it is simply a phishing scam or spam e-mail. The e-mail was this and it essentially asks you to click on a link to receive a “secure message”:

If we actually look at the source of the e-mail though you can see that it tries to trick you into going to another site:

From – Mon Sep 15 14:22:32 2014
Return-Path: <AmericanExpress@welcome.aexp.com>
Received: (fqmail 26683 invoked from network); 15 Sep 2014 20:14:28 -0000
Received: (qmail 11125 invoked from network); 15 Sep 2014 20:14:23 -0000
Received: from [197.1.220.19] ([197.1.220.19])
Received: from (192.168.1.155) by welcome.aexp.com (197.1.220.19) with Microsoft SMTP Server id 8.0.685.24; Mon, 15 Sep 2014 21:14:25 +0100
Message-ID: <4712099136.NMZ97J33257605.907060@rbc.com>
Date: Mon, 15 Sep 2014 21:14:25 +0100
From:”Justin.Fuentes@rbc.com” <Justin.Fuentes@rbc.com>
Subject: New secure message from RBC Royal Bank
Content-Type: multipart/alternative;
boundary=”————07050800302030306010301″

This is a multi-part message in MIME format.
————–07050800302030306010301
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

You have received a secure messageThis is an automated message sent by Royal Bank Secure Messaging Server. The link above will only be active until: 09/16/2014 Please click here or follow this link : https://www1.royalbank.com/cgi-bin/rbaccess/rbcgi3m01 Help is available 24 hours a day by email at secure.emailhelp@rbcroyalbank.com If you have concerns about the validity of this message, please contact the sender directly. For questions about Royal Bank’s e-mail encryption service, please contact technical support at 1-800-769-2511. First time users – will need to register before reading the Secure Message. Help – https://mailsafe.rbcroyalbank.com/websafe/help?topic=RegEnvelopeAbout Royal Bank Encryption – https://mailsafe.rbcroyalbank.com/websafe/about © Royal Bank of Canada 2014 Privacy & Security|Legal|Accessibility|Contact Us|Unsubscribe

You have received a secure message
This is an automated message sent by Royal Bank Secure Messaging Server.
The link above will only be active until: 09/16/2014

Please click href=”http://melissigorta.com/www6.rbc.com/webapp/ukv0/signin/logon.html”>here or follow this link : href=”http://melissigorta.com/www6.rbc.com/webapp/ukv0/signin/logon.html”>https://www1.royalbank.com/cgi-bin/rbaccess/rbcgi3m01

Help is available 24 hours a day by email at href=”http://melissigorta.com/www6.rbc.com/webapp/ukv0/signin/logon.html”>secure.emailhelp@rbcroyalbank.com

If you have concerns about the validity of this message, please contact the sender directly. For questions about Royal Bank’s e-mail encryption service, please contact technical support at 1-800-769-2511.

First time users – will need to register before reading the Secure Message.

Just delete it if you see this message as they essentially want you to think you are logging in the bank’s site when in reality you will be entering your bank details to a third party site.

2 Comments

Destiny Hagest 10/22/2015

Great article! I’ve gotten similar e-mails before. If you’re not paying attention, it’s unfortunately so easy to fall for these scams.
Billy Yarborough 5/23/2018

Got this one in my email- ATTENTION CUSTOMER,

THIS IS TO BRING TO YOUR NOTICE THAT WE HAVE RECEIVED A CODED TELEX MESSAGE OF YOUR $15 MILLION UNITED STATES DOLLARS PAYMENT FILE FROM THE LEGAL ADVISORY OF THE WORLD BANK GROUP, REGARD TO THE UN COMPENSATION BAILOUT FUNDS FOR CITIZENS OF UN MEMBER COUNTRIES AND CITIZENS OF COMMONWEALTH NATIONS FOR POVERTY ALLEVIATION, IN CONJUNCTION WITH THE TELEX TRANSFER INSTRUCTIONS FROM THE UNITED NATION CREDIT CONTROL AND TREASURY BILLS DEPARTMENT. ROYAL BANK OF CANADA (RBC) HAS BEEN INSTRUCTED FOR IMMEDIATE BANK TO BANK ONLINE WIRE TRANSFER OF YOUR TOTAL APPROVED FUND OF $15 MILLION UNITED STATES DOLLARS FOR FINAL ONWARD CREDITING TO ANY OF YOUR NOMINATED BANK ACCOUNT.

IN ACCORDANCE WITH THE PROVISION OF ELECTRONIC FUNDS TRANSFER OF SUB SECTIONS 359(6) OF THE ROYAL BANK OF CANADA (RBC) ALLIED MATTERS ACT 1990, YOUR COMPENSATION FUND WILL BE TRANSFER TO YOUR BANK ACCOUNT WITHIN 15 HOURS, PLEASE EXPEDITE ACTIONS AS THE RIGHTFUL BENEFICIARY, AS THE ADMINISTRATIVE OVERHEADS STATEMENT ACCOUNT VALUED ADDED BALANCE SHEET HAVE BEEN ISSUED IN YOUR FAVOR.

HOWEVER, YOU ARE REQUIRED TO RE-CONFIRM THE FOLLOWING DETAILS AS SPECIFIED BELOW TO ENABLE US CREATE AN ONLINE ACCOUNT AND TRANSFER THE MONEY INTO YOUR ACCOUNT DETAILS AS INSTRUCTED:

FIRST NAME ………
LAST NAME ……….
STATE OF ORIGIN:…
PHONE NUMBER:……
RESIDENTIAL ADDRESS:..
EMAIL ADDRESS:……..
BANK NAME:…….
BANK ADDRESS:….
ACCOUNT NUMBER:..
ACCOUNT NAME:….
ROUTING NUMBER:..

PLEASE DON’T FAIL TO FILL THIS FORM BECAUSE IT WILL HELP US A LOT TO MAKE SURE THAT YOUR FUND TRANSFER IMMEDIATELY. SECONDLY WE ARE SO SORRY FOR OUR LATE RESPOND DUE TO WE HAVE A LOT OF CUSTOMERS TO ATTEND HERE, SO PLEASE FILL THIS FORM FOR THE IMMEDIATE TRANSFER.

ONCE AGAIN I APOLOGIZE FOR THE DELAY; I PROMISE WE WILL STRIVE TO MAKE IT UP TO YOU. THANK YOU FOR GIVING US THE OPPORTUNITY TO SERVE YOUR BANKING NEEDS..

YOURS FAITHFULLY,

DAVID I MCKAY
THE PRESIDENT AND CEO.
ROYAL BANK OF CANADA (RBC).
HEAD OFFICE LOCATION ADDRESS: 200 BAY STREET,
ROYAL BANK PLAZA,
TORONTO, ON, CA, M5J 2J5.
E-MAIL:(rbcroyalbankofcanada2018@gmail.com).