Western Union concern

Reaction score
11
Location
Essex. UK
I have received an Email from Western Union thanking me for registering on line for their services, problem is, I have not signed up to use their services in any way.

Either Western Union have signed me up automatically hoping that I will use their services or someone is trying to scam me.

I checked the links and all lead to Western Union official site.

Th Email was titled correctly to me, but this is easily obtainable through a domain name registration check.

I have Emailed Western Union with my concern but as it's the weekend I do not expect a response.

I'd appreciate any advice.

Here is the message source:

Code:
Received: from coumta56.netbenefit.co.uk ([212.53.64.108])
	by customermail.easily.co.uk with esmtp (Exim 4.63)
	(envelope-from <westernunionresponse@westernunion.com>)
	id 1Nl9ac-00088T-TO
	for h8y9zesvxd24@customermail5.easily.co.uk; Fri, 26 Feb 2010 23:27:22 +0000
Received: from barracuda.westernunion.com ([206.201.226.50]:44320)
	by coumta56.netbenefit.co.uk with esmtp (NBT 4.61 23)
	id 1Nl9ac-0008U2-K8
	for support1@mmpcsolutions.co.uk; Fri, 26 Feb 2010 23:27:22 +0000
Received: from WUPRDMSG01A (unknown [172.27.99.86])
	by barracuda.westernunion.com (Spam Firewall) with SMTP id 34F0B354656
	for <support1@mmpcsolutions.co.uk>; Fri, 26 Feb 2010 18:25:48 -0500 (EST)
Received: from WUPRDMSG01A ([172.27.99.86]) by barracuda.westernunion.com with SMTP id iiP7qneGxYhRHI3B for <support1@mmpcsolutions.co.uk>; Fri, 26 Feb 2010 18:25:48 -0500 (EST)
Message-ID: <80481549.1267224903623.JavaMail.wasadmin@WUPRDMSG01A>
From: westernunionresponse@westernunion.com
To: support1@mmpcsolutions.co.uk
Subject: Western Union: Thank you for registering
Mime-Version: 1.0
Content-Type: multipart/mixed; 
	boundary="----=_Part_325365_2147175693.1267224903623"
Date: Fri, 26 Feb 2010 18:25:48 -0500 (EST)
X-NB-Virus-Scan: virus-free
X-Originally-To: support1@mmpcsolutions.co.uk
X-Originally-To: support@mmpcsolutions.co.uk
X-AntiVirus: checked (incoming) by AntiVir MailGuard (Version: 9.0.1.9; AVE: 8.2.1.176; VDF: 7.10.4.158)

------=_Part_325365_2147175693.1267224903623
Content-Type: text/html; Charset=UTF-8
Content-Transfer-Encoding: 7bit
MIME_Version: 1.0

<html>
<head>
<META http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style>
<!--
		p { 
			font-family: Arial; 
			font-size: 12px; 
			font-style: normal; 
			line-height: normal; 
			font-weight: normal; 
			font-variant: normal; 
			text-transform: none; 
			color: black; 
			text-decoration: none; 
			align="left" }
		p1 { 
			font-family: Arial; 
			font-size: 12px; 
			font-style: normal; 
			line-height: normal; 
			font-weight: normal; 
			font-variant: normal; 
			text-transform: none; 
			color: black; 
			text-decoration: none; 
			align="left" }
		span { 
			font-family: Arial; 
			font-size: 12px; 
			font-style: normal; 
			line-height: normal; 
			font-weight: normal; 
			font-variant: normal; 
			text-transform: none; 
			color: black; 
			text-decoration: none; 
			align="left" }
	-->
</style>
</head>
<body link="#990000" vlink="#990000" alink="#990000" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0">
<table width="605">
<tr>
<td><span>
<br>
<p>Dear MICHAEL MACAULAY,<br>
<br>
</p>
<p>Thank you for registering online with 
	
			Western Union.&nbsp;
		
					We'd like to take this opportunity to welcome you into the
					
							Western Union<sup>&reg;</sup>
					family of services.  
	  We look  forward to assisting you with your money transfer needs now and in the future. <br>
<br>
	By registering with us, you've made it easy and convenient to send money online any time, from anywhere. Your receiver can pick up the money at any of Western Union's convenient Agent locations. <br>
<br>
			Visit us at <a href="http://www.westernunion.co.uk">www.westernunion.co.uk</a> to: <br>
			&nbsp;&nbsp;* Send money <br>
			&nbsp;&nbsp;* Check the status of your order  <br>
			&nbsp;&nbsp;* Search for Agent locations worldwide <br>
				&nbsp;&nbsp;* Learn about other Western Union services <br>
<br>
			If you have questions or need assistance, our customer service team is here to help. 
		<ul style=" margin:0px; padding:0px; padding-left:5px">
<br>	&nbsp;&nbsp;* <a href="https://www.westernunion.co.uk/WUCOMWEB/staticMid.do?countryCode=GB&languageCode=en&pagename=helpContactUs&method=load">Contact us</a> by email.<br>
<br>
</ul>
			We are continually improving our web site to better serve you.  Be sure to check back with <a href="http://www.westernunion.co.uk">www.westernunion.co.uk</a> in the future as we add exciting new services to meet your financial needs.		
		</p>
<p>Thank you for using Western Union!<br>
</p>
<p>
<hr>
				DO NOT REPLY TO THIS EMAIL. IF YOU HAVE QUESTIONS PLEASE <a href="https://www.westernunion.co.uk/WUCOMWEB/staticMid.do?countryCode=GB&languageCode=en&pagename=helpContactUs&method=load">CONTACT US</a>.
			</p>
</span></td>
</tr>
</table>

</body>
</html>

------=_Part_325365_2147175693.1267224903623--
 
I am not an expert but I did not notice anything suspicious in the email header.

If I were you, I'd be on the phone to find out what's up. I think email is too slow for making an inquiry about this.

Anyone you know, who is disgruntled, that could do something against your business?

Hopefully it is nothing...
 
First, go to your website control panel and see if you have a email account named "support1@mmpcsolutions.co.uk", not just "support@mmpcsolutions.co.uk".

I dont know if you do a catchall for anything before the @ symbol or if you use specific emails.

If you do not use a "support1" email check if there is one now OR if there is a forwarder for that email to a third party email address.

Also see if you can detect anything weird about your account or if there is a way to see if anyone has used your control panel lately.

This might just be a new twist on a scam being put on you through WU, but I would check your domain for anything weird, including your website for new files that you did not upload.

edit: Go to the WU site and try to login by telling it your forgot your password, it will ask for email and D.O.B, see if your info matches. See if it will send you the password. If it does, go back and change it right away and then go through your account there to see what info they put in. It will likely have some kind of credit card attached to the account.
 
Last edited:
Seems a little suspicious, but the server path in the headers is all legitimate. Unless the Western Union servers are open relays AND the sender knows your contact info, I'd say it's not very likely that someone else sent you this message.

Any chance someone you know signed you up? ;)

Th Email was titled correctly to me, but this is easily obtainable through a domain name registration check.

Your domain registration data doesn't show your whole name.

Code:
    Domain name:
        mmpcsolutions.co.uk

    Registrant:
        M Macaulay

    Registrant type:
        UK Individual

    Registrant's address:
        The registrant is a non-trading individual who has opted to have their
        address omitted from the WHOIS service.

    Registrar:
        Easily Limited t/a easily.co.uk [Tag = WEBCONSULTANCY]
        URL: http://www.easily.co.uk

    Relevant dates:
        Registered on: 04-May-2007
        Renewal date:  04-May-2011
        Last updated:  07-May-2009

    Registration status:
        Registered until renewal date.

    Name servers:
        dns0.easily.co.uk         212.53.77.27
        dns1.easily.co.uk         212.53.64.31

    WHOIS lookup made at 16:50:06 28-Feb-2010
 
It was attempted fraud.

I phoned western union, someone on the 26th February tried to transfer from Pakistan to Russia £400 but fortunately the transaction was blocked by my bank.

This wasn't a quick swipe though, someone took the effort to find my full name etc.

I have contacted my bank and they have arranged for a new card, the current one is now blocked and cut up.

My only concern is who done it?

I have created an account with Ammyy Admin this month and they are russian but I do not want to jump to conclusions.

Either way, all details are blocked, western union have removed my info and it is getting fully investigated by my bank.

Think I'll do a scan on my PC just to be on the safe side now!

The bastards!
 
.... tried to transfer from Pakistan to Russia £400......

....I have created an account with Ammyy Admin this month and they are russian but I do not want to jump to conclusions.....

I think you could jump to the conclusion and nobody would disagree with you.
 
There are a lot of possible scenarios, but opening and account with a Russian company and then someone trying to withdraw money from your account and route it to Russia sounds like a top-of-the-list sort of link.
 
Re:

It's no rocket science for someone to do a little information gathering on you to find out who you are, where you live, your phone numbers and so on.
Google your name or your business name and see what info has been leaked on the net.

Remember to also teach your employees (if you got any) about these scams, or the people on your household. You are aware of these scams, but they might be not.
 
I have accounts registered with
Western Union
Wells Fargo
The Indian Mothers Association
The Siberian kyak club
The Nigerian Princes Consortium
....
....

Millions of dollars , roubles, yen, Kisi sticks and brown stuff flows daily through my acounts with these respectable institutions.

The interesting thing is that I only started receiving stuff from the first two after I created a PayPal account. Now I use Ebay/PayPal and have a special email account that was created solely for Ebay work. It has only ever been divulged to Ebay/PayPal yet I regularly now get stuff from WU and WF.
 
Last edited:
Ebay didn't sell your email.
They are just so stupid that your email address in their pages code shows as "mailto:name@domain.com".
No encryption, no nothin'.
Any bot can crowl thousands of ebay pages and harvest all the emails it encounters.
 
Back
Top