AOL warns of email scam
The company is warning users that email messages posing as AOL-endorsed offers and notices are really trying to gather sensitive member information.
A number of these messages have such subject headings as "AOL Server Error," "AOL Billing Problem," "Beanie Babies," or "AOL Rewards," and are intended to lure members to open them, according to a cautionary posting on the "Neighborhood Watch" page within AOL's proprietary service.
The warning says the messages contain HTML hyperlinks that lead to Web sites pretending to be a standard registration Web page. But these pages ask for member screen names or passwords, which could potentially lead scammers into AOL member accounts.
One sample email reads: "A database error has deleted the information for over 25,000 accounts, and yours is one. In order for us to access the back-up data of your account, we do need your password. Without your password, we will NOT be able to allow you to sign onto America Online within the next 24 hours after your opening of this letter."
According to AOL spokesman Rich D'Amato, AOL posted its warnings three weeks ago, prompted by "member complaints, as well as emails that we had been seeing."
Scammers obtaining a screen name or password could potentially do considerable harm on an AOL member's account. An account violator could use the member's communications features, such as email and the instant messenger buddy list, or even purchase goods with the member's credit card.
AOL in the past has suffered break-ins from account "crackers." Some break-ins came from furtive "social engineering" techniques such as when a cracker convinces a billing administrator to hand over sensitive information without fully screening for verification. Other AOL accounts, such as companies setting up their presence on the service, have been compromised and defaced.
D'Amato added that AOL will never ask members for their screen name or password, and the firm continues to try to fight mass unsolicited email senders, or "spammers."
"When it comes to spamming, we want to find out who is sending these emails to block them and, when appropriate, to prosecute," said D'Amato.
He declined to disclose how many user accounts were violated as a result of the phony emails.