Phishing Scam Targets Summer Travelers

      I always thought computer hackers had to be smart. But after receiving an email that said it was from Delta Air Lines, I learned that many computer hackers are just plain dumb.

      Still, millions of people have their personal information stolen and end up with viruses on their computers because they think these emails are real and they click on the link to see more information. It's called a phishing scam.

     Wikipedia defines a phishing scam as "a way of attempting to acquire information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an electronic communication. Basically, someone sends you an email that looks like the real deal. They are hoping you will bite, thus the term phishing.

      The email I received on June 19, 2012 had a subject line that read, "Your ticket." The address it came from was information@delta.com. Since I travel all the time, that was enough for me to open the email and look into it more. This is when people behind this email phishing scam lost me as a potential victim.

      The email I received, claiming to be from Delta Airlines. This is not what a confirmation from Delta looks like.


     They lost me as a potential victim because the email didn't look anything like a real Delta Air Line's itinerary or confirmation email you receive after you book a flight. You may be wondering, why would anyone even look at this email if they are not flying with Delta? They probably wouldn't but during the busy summer travel season, the people behind this scam are hoping that they get inside a few in boxes of travelers who did book reservations with Delta.

     These travelers may think that Delta is notifying them about something or they may think Delta is sending them a receipt. They may also think it's a mistake and get alarmed when they see a line inside the email confirming their credit card paytment to Delta. This is when some of those potential victims actually become victims.

    Attached to the email is a "zip" file that says, "Ticket_Delta-Air_Lines. The scammers are hoping you will click on the "zip" to download the ticket and view it. Delta Air Lines tells us they have received complaints about this phishing scam and warn people if you click on the link, a virus could be downloaded to your computer or your personal information could be stolen.

       The top portion of a real Delta confirmation. Notice the Delta logo and bar code

The bottom portion of a real Delta email confirmation.

     I have posted two images above showing what a real Delta confirmation looks like. When Delta sends you an email, it usually comes from an email address called - "DeltaElectronicTicketReceipt@delta.com." There is always a confirmation number, a ticket number and the subject line of the email usually looks something like this: "Joel C FT LAUDERDALE 18JAN07" That subject line displays part of your name, the city you are departing from and the date of your trip.

     In the phishing email I received, the subject line just said, "Your ticket." Once I opened the email, it displayed a very elementary-looking itinerary, that listed a few key terms like "Number of bags" and my seat and phony ticket numbers.

     The question now is did these email scammers get our email addresses from data they stole from Delta Air Lines or is this just a mass email sent out to millions of people. My email appears to be a part of a mass email. I was one of several people listed as recipients.

     In a written statement to us, Delta Says, "because Delta is not the source of the fraudulent email, we cannot speculate on how the addresses were obtained or how many emails were sent. Delta’s information security team is continuing to monitor the situation and have confirmed that no customer data was compromised."

     Even though Delta says in their statement that no customer data was compromised, the airline goes on to say, "we recommend you change your SkyMiles account PIN immediately and monitor your account for any misuse."

     The bottom line is this was a very badly put together phishing scam that probably didn't hurt too many computers. But every phishing scam catches some victims. In a case like this, where hundreds of thousands of phony emails may have been sent out, some people had to fall for it and that is exactly what these scammers are hoping for. For them, even hooking one "phish" is a catch.