This afternoon I received an email with the subject “Worldpay CARD transaction Confirmation“, which instantly caught my attention because I use Worldpay while paying off one of my credit cards, and for a moment I wondered if I had done it and forgotten about it.
The email content was as follows:
Thank you!
Your transaction has been processed by WorldPay, on behalf of Amazon Inc.
The invoice file is attached to this message.
This is not a tax receipt.
We processed your payment.
Amazon Inc has received your order,
and will inform you about delivery.
Sincerely,
Amazon TeamThis confirmation only indicates that your transaction has been processed successfully.
It does not indicate that your order has been accepted.
It is the responsibility of Amazon Inc to confirm that your order has been accepted, and to deliver any goods or services you have ordered.
All very convincing and official-looking, but Amazon doesn’t use Worldpay, and the email was not sent to amazon@<my email domain> – it was sent to my office address which is only used for, well, office stuff.
The email attachment is a simple HTML file so it is not picked up as anything dodgy, but it comprises a single META REFRESH line directing you to an executable file hosted elsewhere, so don’t open the attachment.