Name	Last modified	Size

Parent Directory		-
README.html	2023-08-06 21:04	12K
info.json	2023-08-06 21:04	40
tags=meta	2023-08-06 21:04	0

Employment Scam: The Dissection

The job situation in America is still pretty bad, and a lot of unscrupulous people run employment scams that make a bad situation even worse for the gullible targets they find. Here is an example of a recent message that came my way:

Return-Path: <affinity.ma@proactmail.com>

X-Original-To: TheUniqueEmailAddress

Received: from 124-93.rs.smtp.com (124-93.rs.smtp.com [74.91.93.124])

	by homiemail-mx7.g.dreamhost.com (Postfix) with ESMTP id 913CFCF3B0

	for <TheUniqueEmailAddress>; Mon, 21 Jan 2013 07:15:07 -0800 (PST)

X-MSFBL: bWlubmVzb3Rhd29ya3MubmV0QDFxMjAxMy5zdWJzdW1lLmNvbUA3NF85MV85M18x

	MjRAcHJvYWN0cmVjcnVpdG1lbnRzX2RlZGljYXRlZF9wb29sQA==

DKIM-Signature: v=1; a=rsa-sha256; d=smtp.com; s=smtpcomcustomers; c=relaxed/simple;

	q=dns/txt; i=@smtp.com; t=1358781306;

	h=From:Subject:To:Date:MIME-Version:Content-Type;

	bh=+BpE3+2xPuv53JLzfXaenJw0MAsmMQRLiEakwDUnI0c=;

	b=vo0u7bqzwTU/f2qBoPPo6Bb5AxyU04FJR45G8LVq2hRfC9IyjZ5wVKGlj7XH31jZ

	OF7NgzGRICV4UPHiAbTrlQcBpAJHlnJBDuazwpOo/vy6Edij1NwqVV6x+gUWjB51

	TBbC6z9xEC/gachIr7rPh63dAC2lFJ/cdkAfe/WOFLA=;

Received: from [173.8.118.229] ([173.8.118.229:4825] helo=proactmail.com)

	by rs-ord-mta04.smtp.com (envelope-from <affinity.ma@proactmail.com>)

	(ecelerity 3.3.2.44647 r(44647)) with ESMTP

	id 97/7C-28209-A7B5DF05; Mon, 21 Jan 2013 15:15:06 +0000

Received: from adama ([192.168.0.6]) by proactmail.com

	with SMTP (Code-Crafters Ability Mail Server 2.71);

	Mon, 21 Jan 2013 09:15:06 -0600

Thread-Topic: Member Advisor Position

thread-index: Ac336hf6aTVkpTuBQn60y2G+ByO7Og==

From: <affinity.ma@proactmail.com>

To: <TheUniqueEmailAddress>

Subject: Member Advisor Position

Date: Mon, 21 Jan 2013 09:15:06 -0600

Message-ID: <24C710292B774A3D888964EA64AE754C@Metrisource.local>

MIME-Version: 1.0

Content-Type: multipart/alternative;

	boundary="----=_NextPart_000_0190_01CDF7B7.CD605210"

X-Mailer: Microsoft CDO for Windows 2000

Content-Class: urn:content-classes:message

Importance: normal

Priority: normal

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.3959

X-SMTPCOM-Tracking-Number: d460876a-94a8-4749-bbf3-a61bf99a3f5b

X-SMTPCOM-Sender-ID: 81499

X-SMTPCOM-Spam-Policy: SMTP.com is a paid relay service. We do not tolerate UCE of any kind. Please report it ASAP to abuse@smtp.com
This is a multi-part message in MIME format.
------=_NextPart_000_0190_01CDF7B7.CD605210

Content-Type: text/plain;

	charset="iso-8859-1"

Content-Transfer-Encoding: 7bit
Hello Darrin,
My name is Sara Pook, and I work on the Human Resource Team for Affinity

Plus Federal Credit Union. I recently saw your resume on-line and I feel

that your background along with your experience would be a potential fit

for our Member Advisor position that we have available in our Roseville

Branch. Please review the following information below, and if you feel

you are both qualified and interested, follow the directions below to

apply.
As a Member Advisor, we expect you to connect with our members, assist

them with routine banking needs and partner with them through

significant life events. We expect you to build relationships founded on

trust with our members, which includes making decisions that are aligned

with what is right for each individual member, taking ownership of your

own development and delivering a meaningful experience for our members.

Being a Member Advisor at Affinity Plus is a career where you place

people over profits. Our ideal candidates will have to have an intrinsic

drive to connect with people, an enthusiasm to seek creative ways to

make a difference in each member's life and a tenacity to find solutions

that might not be the ones you have tried in the past. Affinity Plus is

a fast-paced and innovative environment that is both challenging and

rewarding.
A career at Affinity Plus is not for the temporary job-seeker, but it IS

for those who are passionate about impacting the lives of others. If

this position sounds like the fulfilling career you are seeking, please

visit us at http://www.affinityplus.org

<http://www.metrisource.com/Ess/ClickThrough.asp?URL=http://www.affinity

plus.org&ID=1019&CID=8132446>  and apply online.
We are an organization that celebrates diversity. EOE. 
Thank you,
Sara Pook

HR Specialist | Affinity Plus Federal Credit Union

175 W Lafayette Frontage Rd | St. Paul, MN 55107 
Go to http://www.metrisource.com/donotsend/ to be added to the Do Not

Send list and enter CODE: 172-8132446 or you may simply reply to this

email with the phrase REMOVE ME in the subject line.
------=_NextPart_000_0190_01CDF7B7.CD605210

Content-Type: text/html

Content-Transfer-Encoding: 7bit
<html><body><font size=2 face=tahoma>Hello Darrin,<br>

<br>
<p>My name is Sara Pook, and I work on the Human Resource Team for Affinity Plus Federal Credit Union. I recently saw your resume on-line and I feel that your background along with your experience would be a potential fit for our Member Advisor position that we have available in our Roseville Branch. Please review the following information below, and if you feel you are both qualified and interested, follow the directions below to apply.</p>
<p>As a Member Advisor, we expect you to connect with our members, assist them with routine banking needs and partner with them through significant life events. We expect you to build relationships founded on trust with our members, which includes making decisions that are aligned with what is right for each individual member, taking ownership of your own development and delivering a meaningful experience for our members. Being a Member Advisor at Affinity Plus is a career where you place people over profits. Our ideal candidates will have to have an intrinsic drive to connect with people, an enthusiasm to seek creative ways to make a difference in each member's life and a tenacity to find solutions that might not be the ones you have tried in the past. Affinity Plus is a fast-paced and innovative environment that is both challenging and rewarding.</p>
<p>A career at Affinity Plus is not for the temporary job-seeker, but it IS for those who are passionate about impacting the lives of others. If this position sounds like the fulfilling career you are seeking, please visit us at <a href="http://www.metrisource.com/Ess/ClickThrough.asp?URL=http://www.affinityplus.org&ID=1019&CID=8132446">http://www.affinityplus.org</a> and apply online.</p>
<p>We are an organization that celebrates diversity. EOE. <br>

<br>

Thank you,<br>

<br>

Sara Pook<br>

HR Specialist | Affinity Plus Federal Credit Union <br>

175 W Lafayette Frontage Rd | St. Paul, MN 55107

</p></font><p></p><p></p><p><font face=Arial size=-2>Go to http://www.metrisource.com/donotsend/ to be added to the Do Not Send list and enter CODE: 172-8132446 or you may simply reply to this email with the phrase REMOVE ME in the subject line.</font></p></body></html>

------=_NextPart_000_0190_01CDF7B7.CD605210--

Now you may get emails like that every day and just let the filters delete them without a second's thought. But I rarely get such messages due to the way I manage my contacts. But even more significant is the fact that the purported employer, Affinity Plus, is actually the credit union I have been a member at for over 20 years! Clearly I had to look into this further.

Is it spam? Check!

The email address used, for which I substituted TheUniqueEmailAddress, is not the one I've given to Affinity Plus for my regular financial business. Rather, it has been harvested from the resume that I had listed on the State of Minnesota's employment site. And at the exact same time I got the above message, I also got 3 other spam in the same vein (e.g., Sale Position at Farmers Insurance). Nothing could more clearly be unsolicted bulk email. Such use of harvested email addresses may even be illegal under the CAN-SPAM Act of 2003.

Is it fraudulent? Check!

Although the link in the body claims to send you to affinityplus.org, it actually sends you to metrisource.com. It is dangerous to click on such a link, or really to click anything in such an untrusted email. Among the things an employment scam might misdirect you to is anything from a drive-by download to install malware on your computer, to more direct phishing attempts that try to get your personal information with the intent of identity theft.

Is it Affinity Plus?

This became the important question. There were a couple possibilities that came to my mind.

Someone is fraudulently claiming to be Affinity Plus

This possibility is the most straightforward. If someone is pretending to be them on the Internet, I am certain Affinity Plus would take action to end it. All I have to do is contact them to let them know it is happening, and they'll take care of the rest.

Affinity Plus is engaged in the fraud themselves

This possibility is the most disturbing. The body of the spam has a person claiming to have read my resume, but anyone who has actually read my resume would see pretty quickly that I am a software architect and developer, which is nothing like the Member Advisor position offered in this spam (or the Sales positions offered in the other spam). But beyond the ethical lapse of that claim, a more disturbing picture is painted: If Affinity Plus HR is the true source of these emails, that means they are intentionally seeking out and hiring employees that have unsafe, insecure habits when it comes to handling electronic communications. That's not reassuring to me as a member and, because their deposits are insured by the NCUA, every taxpayer has to foot the bill when there is a breach in security.

Either way, I decided to ask them if they knew this was going on.

Which was it?

Stay tuned next week for the post where I reveal my findings.

Update: The timeline is now available.

Permanent Links

Poll

Tech Corner

See Also