Identifying false (spoofed) emails

You may receive emails from VegaVend, such as Sold, Ship Now emails or Technical Notification emails. However, sometimes you might receive emails that are not really from VegaVend, even if at first glance they may appear to be. Instead, such emails are falsified and attempt to convince you to reveal sensitive account information.

These false emails, also called ‘spoofed’ emails or ‘phishing’, look similar to legitimate emails from VegaVend. Often these emails direct you to a false website that looks similar to an VegaVend website, where you might be asked to give account information, such as your email address and password combination.

Unfortunately, these false websites can steal your sensitive information, which can then be used without your knowledge to commit fraud.

To protect yourself from responding to these emails, you can follow some simple rules:

What VegaVend will never ask for

VegaVend will never ask you for the following information in an email communication:

• • Your National Insurance Number

• • Your bank account information, credit card number, PIN number or credit card security code (including ‘updates’ to any of the above)

• • Your mother’s maiden name or other information to identify you (such as your place of birth or your favourite pet’s name)

• • Your VegaVend or Vendor Dashboard password

Review the email for grammatical or typographical errors

Be on the lookout for poor grammar or typographical errors. Many phishing emails are translated from other languages or are sent without being proof-read. As a result, these messages can contain bad grammar or typographical errors.

Check the return address

Genuine emails from VegaVend always will come from an address ending in ‘@VegaVend.com’ or the email addresses listed here:

• • VegaVend.co.uk

• • VegaVend.de

• • VegaVend.es

• • VegaVend.fr

• • VegaVend.it

• • VegaVend.lu

• • vegavend.co.za

Check the email’s header information. If the ‘received from’, ‘reply to’ or ‘return path’ for the email does not come from one of the sources above, it is not from VegaVend. Most email programs let you examine the source of the email. The method that you use to check the header information varies depending upon the email program that you use. The following are some examples of fraudulent return addresses:

• • Vendor-performance@payments-VegaVend.com

• • VegaVend-security@hotmail.com

• • VegaVend-payments@msn.com

Check the website address

Some phishers set up spoofed websites that contain the word ‘VegaVend’ somewhere in the URL. Genuine VegaVend websites always end with ‘.VegaVend.com’ – that is, ‘www.VegaVend.com’, or ‘www.VegaVend.co.uk’.

We never use a combination such as ‘security-VegaVend.com’ or ‘VegaVend.com.biz’.

When in doubt, go directly to the Vendor Dashboard

Some phishing emails include a link that looks as though it will take you to your Vendor Dashboard, but it is really a shortened link to a completely different Website. If you hover over the link in your email client, you can sometimes see the underlying, false web address, either as a pop-up or as information in the browser status bar.

The best way to ensure that you do not respond to a phishing email is to always go directly to your Vendor Dashboard to review or change anything about your account after entering your password.

Note: Never click a link embedded in an email.

Note: In some cases, hovering your mouse over a link can still show a spoofed address instead of the real address. Do not depend upon hovering over a link to determine whether a link is real. In every case, never click a link embedded in an email.

Do not ‘Unsubscribe’

Never follow any instructions contained in a forged email that claim to provide a method for ‘unsubscribing’. Many spammers use these ‘unsubscribe’ processes to create a list of valid, working email addresses.

Use the features in Vendor Dashboard to track your orders

The Sold, Dispatch Now email can be a useful tool, but the most accurate and up-to-date information for your orders is always found by clicking the Orders tab in Vendor Dashboard. The default page, Manage Orders, shows you the most recent orders.

Help stop phishers and spoofers

You can make a difference! VegaVend has filed several lawsuits against phishers and spoofers; these lawsuits came about from information provided to VegaVend via the stop-spoofing@VegaVend.com email address.

Report spoofed emails to VegaVend

• • Create a new email to stop-spoofing@VegaVend.com and attach the original, spoofed email. Sending the email as an attachment is the best way to preserve the ‘header information’, which makes it easier for VegaVend to trace the origin of the forgery.

• • If you cannot send the forged email as an attachment, forward the email to stop-spoofing@VegaVend.com, and include as much of the header information as you can.

To locate the header information, configure your email program to show All Headers. (This varies, depending on the email program that you use.) The headers we need are well labelled and will look similar to this example:

X-Sender: someone@domain.com

X-Sender-IP: [10.1.2.3]

X-Date: Tue, 08 Apr 2003 21:02:08 +0000 (UTC)

X-Recipient: you@domain.com

X-OUID: 1

Note: VegaVend is not able to respond to all emails reporting spoofed emails or phishing, although we do read them and take action as appropriate. If you have specific questions about your account, search Vendor Dashboard Help or contact us.