THIS warning on the top of the front page English BM bikes forum might be valid for some members here as there is a lot of Motorworks customers in here.

Thanks for passing on the warning Inge K. Sadly, there are lots of scammers about so you do need to be careful with email traffic, especially when it seems to come from a familiar source.

Quick way to pick up a suspect email: if there's a return link ('click here' or something similar), hover your mouse over the link and check the status bar at the bottom of your browser. It should display the actual link; if it doesn't match the supposed recipient than introduce the email to the trashcan. Not foolproof but will catch 90-odd percent of spoofed email addresses.

good warning Inge ..

cheers for passing it on

I mustn't be that good of a customer...I didn't get it ! 

I just got a mail from them telling me to ignore it but like 88 I did not get the bad mail.

Ringfad wrote:I just got a mail from them telling me to ignore it but like 88 I did not get the bad mail.

Me too - but a day after Inge K told us about it. I guess news travels faster East than it does South...must be something to do with the jet stream.

I got the email telling me about the problem, but not the problem email.

Funny thing, though - the genuine warning from motorworks went into my spam folder. 

Bill

Yeah! I have now received a bogus email that is pretending to come from Motorworks...it auto directed into my spam folder. on 20 Sep (good result).

The email address is extremely close to the official "no reply" one that comes with your confirmation of an order but has noreply as a single word rather than no_reply as motorworks use. The rest of it is identical, so it does look like it is authentic. 

The following detail is on the motorworks website:

Fraudulent Emails
We are sorry to report that some personal data held for the purposes of making our web site easier to use has been stolen.
Dealing with this breach of data security is our top priority and we are working urgently on measures to prevent this happening again. Motorworks is a small company of enthusiasts who take your data security very seriously. 

What We Know

1. Fraudsters have stolen the names, addresses, telephone numbers and email addresses of a number of customers from the database that is linked to our web site. Our web site is hosted by a reputable UK based company who are assisting our investigations
   
2. This information has been used to send fraudulent phishing emails to the affected customers requesting that the recipient click through to an overseas web site. Two emails have been sent so far but it is possible that more emails may be sent using the data that has already been stolen....
   

 
There is more detail on the motorwork website, for any concerned people out there - but it is clearly more serious than first anticipated. Keep an eye on your inboxes/spam folders.

Needless to say - the bogus email didn't leave my spam folder and it has been deleted - no links were followed, I haven't given my visa card details to any little sh*te "overseas" and I am not expecting to be receiving a free helmet any time soon. I haven't actually ordered anything from motorworks since 2014 and have moved house twice since then, so it is likely the fraudsters will have my wrong address anyway!

I have just received the fraudulent email offering the free helmet. This has some personal information - has anyone suffered any credit card charges ?

The personal details database and the stored card number database should be totally separate, preferably on different servers. In addition, the CN database should have salted hashes to seriously encrypt the card number. In the UK, in the case of both credit cards and debit cards, if unauthorised charges do arise as the result of a CN database breach then you're covered. Just notify your bank/building society IMMEDIATELY you see anything suspicious.

If the CN database does get breached, provided the hashes are salted correctly and the encryption is a good one, it is close to (but not impossible) to retrieve the original card numbers. Most database breaches are the result of either poor or sometimes non-existant encryption (yes! card numbers stored in clear text with direct links to personal information - unbelievable but true) or because the database has not been patched up-to-date, thus allowing the bad guys to exploit any weaknesses in the code.

Guess who NEVER stores his card details online. Well, except for Paypal and that's pretty well covered in the case of a breach. I hope.

Yes, my job makes me paranoid about some things. Pity the current generation who have never not known the internet and give out financial information without a care in the world.