carolinefromlon

Q: I opened a scam attachment: what do I do?

Dear All,

 

I've been rather foolish and opened an attachment that came with what is now obvious to me as a scam.  It purported to be from a bank.

 

I've deleted the attachment from my downloads folder.

 

Does anyone have advice?  Should I take further action?  Should I look out for any unusual behaviour from my Mac?  Should I download or purchase antivirus/antimalware software?

 

Your help greatly appreciated.

 

Thank you in advance,

 

Caroline

MacBook Pro with Retina display, OS X El Capitan (10.11.4)

Posted on Apr 27, 2016 12:58 AM

Close

Q: I opened a scam attachment: what do I do?

  • All replies
  • Helpful answers

Page 1 Next
  • by chroot,

    chroot chroot Apr 27, 2016 1:05 AM in response to carolinefromlon
    Level 4 (1,099 points)
    Apr 27, 2016 1:05 AM in response to carolinefromlon

    What type of file was it that you opened?  Was it an image, text file, word document, etc.. ?

  • by carolinefromlon,

    carolinefromlon carolinefromlon Apr 27, 2016 1:19 AM in response to chroot
    Level 1 (4 points)
    Mac OS X
    Apr 27, 2016 1:19 AM in response to chroot

    Dear chroot,

     

    Thanks for such a swift response.

     

    The file was unreadable (just lots of code) but I think the suffix was .js

     

    Does that help at all?

     

    Thanks.

  • by chroot,

    chroot chroot Apr 27, 2016 2:31 AM in response to carolinefromlon
    Level 4 (1,099 points)
    Apr 27, 2016 2:31 AM in response to carolinefromlon

    If it has a *.js extension then it was probably a javascript.  If you can copy the contents of the file into http://pastebin.com we can find out what it's doing.  If it opened in a text editor then it actually did not do anything.

  • by carolinefromlon,

    carolinefromlon carolinefromlon Apr 27, 2016 7:21 AM in response to chroot
    Level 1 (4 points)
    Mac OS X
    Apr 27, 2016 7:21 AM in response to chroot

    Dear chroot,

    Sorry, I have been away from my desk for the last few hours.

    I have not used pastebin before.  Do I just paste the text, and then press 'create new paste'? do I need to fill in the optional settings? Are you able to access it directly?

    I am also a bit concerned because I need to download the corrupt file again as I binned it as soon as I realised what I had done.

    Many thanks for your help.

    Caroline

  • by Linc Davis,Helpful

    Linc Davis Linc Davis Apr 27, 2016 8:05 AM in response to carolinefromlon
    Level 10 (207,963 points)
    Applications
    Apr 27, 2016 8:05 AM in response to carolinefromlon
    Should I take further action?  Should I look out for any unusual behaviour from my Mac?  Should I download or purchase antivirus/antimalware software?

    No on all counts, especially the last.

  • by carolinefromlon,

    carolinefromlon carolinefromlon Apr 27, 2016 8:06 AM in response to Linc Davis
    Level 1 (4 points)
    Mac OS X
    Apr 27, 2016 8:06 AM in response to Linc Davis

    Dear Linc,

    Thank you for advice.

    Best,

    Caroline

  • by JimmyCMPIT,Solvedanswer

    JimmyCMPIT JimmyCMPIT Apr 27, 2016 8:28 AM in response to carolinefromlon
    Level 5 (7,491 points)
    Mac OS X
    Apr 27, 2016 8:28 AM in response to carolinefromlon

    if it's purporting to be from a bank ignore it, if it tried to appear like it was your bank maybe let your bank know.

  • by carolinefromlon,

    carolinefromlon carolinefromlon Apr 27, 2016 8:35 AM in response to JimmyCMPIT
    Level 1 (4 points)
    Mac OS X
    Apr 27, 2016 8:35 AM in response to JimmyCMPIT

    Thanks Jimmy.

    Best,

    Caroline

     

    ps, I am not experienced at using community support.  I seem to be unable to click the star- and I notice that 'solved' appears in the right hand side of your response. I am not sure if the issue is quite resolved. I am waiting for a response from chroot.

  • by pinkstones,

    pinkstones pinkstones Apr 27, 2016 8:55 AM in response to carolinefromlon
    Level 5 (4,209 points)
    Safari
    Apr 27, 2016 8:55 AM in response to carolinefromlon

    carolinefromlon wrote:

     

    Thanks Jimmy.

    Best,

    Caroline

     

    ps, I am not experienced at using community support.  I seem to be unable to click the star- and I notice that 'solved' appears in the right hand side of your response. I am not sure if the issue is quite resolved. I am waiting for a response from chroot.

     

    Jimmy's response looks the way it does because you marked it solved.  You're the only person that can do that.  It also can't be undone, not even by the Hosts.

  • by JimmyCMPIT,

    JimmyCMPIT JimmyCMPIT Apr 27, 2016 9:08 AM in response to carolinefromlon
    Level 5 (7,491 points)
    Mac OS X
    Apr 27, 2016 9:08 AM in response to carolinefromlon

    not a problem

    do you have a subject line or some content that does not have any personal info?

    if so it might be a common scam and one that's been documented as to what it's trying to do

    if there is no personal info in it you can screen shot it here (do not include YOUR actual email, we don't need it)

    How to take a screenshot on your Mac - Apple Support

     

    also if you "roll over" (roll your pointer over the link) any of the links you will see a URL on the bottom of your mail of the actual destination so while it might say

    visit us a www.mybank.com/account_reset.aspx, the link might actually go to www.nogoodnicks.com/please_give_us_your_password.aspx

    or something slightly different you wouldn't' notice if you didn't scrutinize like www.mybank.frog.com

    in which case look at the name right before the last dot. "mybank.com" is likely your bank, "mybank.frog.com" is owned by "frog.com" and they have nothing to do with your bank, at least I wound not think so. Calling your bank might give you insight as to if they would ever send you anything like that (most of the time they do not and they are clear about it) and sometimes banks will post a purported scam on their website as an alert but won't email you to tell you about it, you can simply visit them and see if they know about it.

  • by carolinefromlon,

    carolinefromlon carolinefromlon Apr 27, 2016 9:07 AM in response to pinkstones
    Level 1 (4 points)
    Mac OS X
    Apr 27, 2016 9:07 AM in response to pinkstones

    Dear Pinkstones,

    Thanks for letting me know about the 'solved' mark.  I was trying to click on star but nothing was happening.  Tried to press on star with your post, but again nothing happened.

    Best,

    Caroline

  • by pinkstones,

    pinkstones pinkstones Apr 27, 2016 9:13 AM in response to carolinefromlon
    Level 5 (4,209 points)
    Safari
    Apr 27, 2016 9:13 AM in response to carolinefromlon

    carolinefromlon wrote:

     

    Dear Pinkstones,

    Thanks for letting me know about the 'solved' mark.  I was trying to click on star but nothing was happening.  Tried to press on star with your post, but again nothing happened.

    Best,

    Caroline

     

    You don't press the star itself, you click on "This helped me," if you want to acknowledge someone's response.  You can only do it up to two times.

  • by carolinefromlon,

    carolinefromlon carolinefromlon Apr 27, 2016 11:47 AM in response to JimmyCMPIT
    Level 1 (4 points)
    Mac OS X
    Apr 27, 2016 11:47 AM in response to JimmyCMPIT

    Hi Jimmy,

    Sorry I was not able to reply sooner. Thanks for all your advice.

     

    subject line of email: 992_853.-n

    I attach screen shot of email. It is so clear that is not from my bank, but I was half-asleep this morning when I opened it!

    When I rolled over the link, a lot of number and letter came up; amongst them was "Facre-services.com".

    I look forward to hearing from you.

    best, Caroline

     

    Screen Shot 2016-04-27 at 18.04.51.png

  • by carolinefromlon,

    carolinefromlon carolinefromlon Apr 27, 2016 11:55 AM in response to pinkstones
    Level 1 (4 points)
    Mac OS X
    Apr 27, 2016 11:55 AM in response to pinkstones

    Dear pinkstones.

    I still can't activate the star or 'this helped me'- have refreshed the page and logged out and then in, but still not working.

    Best, Caroline

Page 1 Next