Scam Alert | VA Directory

MailChimp account hacked

This happened to a client of mine late last year and it was a challenging thing to get sorted and MailChimp people were wonderful, helping us through this.

What happened? Someone accessed her account, uploaded over a million addresses and started to send out phishing email saying that payment was due on an invoice and the recipient’s credit card was going to be charged. People began emailing and ringing my client anxious that she was going to charge their accounts for a large sum. Some were rude, many unsubscribed and when I became aware of it could see that emails were still going out via MailChimp. I halted it and contacted MailChimp support for help.

My poor client refused to answer the phone after some time – it was getting too overwhelming. Some of her clients contacted me because they wanted to know what was going on and couldn’t get hold of her. It was a real dilemma and challenge for my client, and for MailChimp too. Further my client was billed a huge amount by MailChimp because of the huge addition to her mailing list.

What could have been done to prevent this activity? I believe there are a few things here that could have saved my client some grief and wasted time too, not to mention the loss of some of her subscriber list and people getting angry for something she didn’t do.

My client has had a multitude of people doing things for her over the years, often with the same password. If you are someone who uses VAs to support you, or you’re a VA taking over from someone else, I urge you to create a new password immediately. Whether it was someone who previously worked with her, or someone who had access to login details from a former worker, we have no way of knowing, but clearly changing it to a strong password would have helped in this regard.
I was very amazed that MailChimp had allowed a very large list to be uploaded to an account without having some sort of alarm system or alert in place – even if it’s to contact the client direct (not via the MailChimp system) to make sure that the activity was genuine. Perhaps they could have a payment system or something in place for increments of a list when it’s clear that a very large list is being uploaded.

Once MailChimp was aware that my client and I weren’t the ones uploading the list or sending out the phishing email they halted the process but it took several days before they could clean the account back to what it was and let my client have access again. In the meantime she couldn’t send a broadcast email to the remainder of her active list advising what had happened. All she could do was wait as she didn’t have a back up copy of her list on her computer either. It was one of the first things we did when she could log in again.

Once my client had regained access to her MailChimp account, an email was sent out with an apology and assuring all her subscriber list that she didn’t have their credit card details and certainly had no reason to be invoicing them or charging them for anything.

I believe it’s important for us, as VAs, to protect our clients’ accounts and keep things as safe as possible. Alert them to possible problems, advise them that you feel passwords should be changed. I had mentioned before how important it was and this very happening was timely, but costly, for my client’s business. Consequently passwords for everything got changed thereafter.

Make sure you don’t use easy passwords either. Family names, birth dates, postal codes and places of living or birth are out. You can use an online password generator but then have to remember what the different passwords are. I often find using a six lettered word, split in half, with the initials of the account, MC for MailChimp, for example, plus some symbols and numbers inserted in the middle and around the word are a good way to remember passwords while making them at least 10 characters long and stronger.

Kathie Thomas

Kathie is the owner of VA Directory and is former past President of the Australian VA Association. She founded the Virtual Assistant industry in Australia in the mid 90s, having already been operating a home-based secretarial service. Today the VA industry covers a multitude of office-based services for clients worldwide.

Beware the fake LinkedIn connection emails

I’ve begun receiving a spate of fake LinkedIn Connection requests and ‘Learn about your new connection’ emails. They look pretty authentic but with an image missing here and there. What clued me in was I never remembered sending an invitation to the names that have been coming. I rarely, if ever, invite someone I don’t know personally.

When you hold your mouse over the hyperlink you get addresses like http://radio-roadrunner.de.vu/linkedwith.html and there have been many others. They always have some kind of reference to ‘linked’ but other words in the address. Here’s an example of what I’ve received below. So, be careful. Make it a habit to accept invitations at LinkedIn itself, not via the email, unless you’re positive the hyperlink is correct. The scammers are very tricky these days! Click on the image to get a larger view. Note the from address and other info which looks genuine.

Kathie M Thomas

Beware of job scams

I had someone fill out my job request form the other day and I asked for more information before sending it out. It’s not unusual for clients to be vague when filling out the form so I usually do ask for more info when that’s the case. Glad I did as what she is outlining below is (I believe) a variation on the ‘receive the funds on my behalf, keep some for yourself and send the rest to me’ scam. I believe this is money laundering and she may be targeting VAs in Australia so please spread the news to any other Aussie based VA networks you may belong to.

The fact she hasn’t addressed me personally below, even though she received a personal response from me, indicates she may have sent this to a group of VAs.

I did wonder if it was perhaps a slight chance of being real – if it were, then she would be needing to provide legal documentation for setting up a business bank account here and if it were me, I’d be involving Austrade to get their help as they are keen to promote business liaisons with different countries. Emily has indicated she’s in the US and has provided a phone number but I have no way of knowing if it’s real or not, unless I call it – I don’t intend doing that.

Anyway, here’s a copy of what was sent me as I hope this will alert anyone else who has been contacted about a similar ‘job’.

Hello Assistant,

I am very glad to read from you pretty soon, I really appreciate your effort writing to me. My name again is Emily Grant, I am a Geologist and I deal in the buying and selling of Gemstones all over the world. I get most of my stones from Asia, Middle east and Africa and after the final processing I make sales throughout the globe as well. I have many clients spread all over the World, But most of my clients are Aussies residing in Australia. I used to have a Personal Assistant in Australia that helps in my business transaction when it come to buying and selling of gemstones within Australia but unfortunately I lost her in an autocrash and since then my business in Australia has been retrogressing due to non availability of my personnel in collection of funds and distribution of goods to clients within Australia.

I contacted you because I am seeking someone to represent my business in Australia, You will be representing my business as a third party which your task will be collecting of funds from clients and after confirmation of these funds their goods will be released to them. You don’t need to be going all around to collect funds or demanding funds from our clients all what you need to do is to open a new bank account of our prescribed bank with online banking which will be monitored by only you on the internet and must have an ATM card due to collection of funds at the bank after or before banking hours should incase of emergency in transferring funds. You will be dealing with local clients and not buyers outside Australia for proper documentation in case of tax payment and other policy. For every transaction made 10% of the total funds will be yours and all expenses made will be deducted from the total fund as well. Proper documentation of all transaction will be recorded by you after collection of funds and transferring of funds to any designated person or representative around the world to keep our business going.

I am very sure these tasks are easy and can be taken care of by you.

If interested kindly get back to me by filling below..

N.B—- Respond all messages via email address given

FULL NAME:
ADDRESS:
CITY:
STATE:
CODE;
MOBILE PHONE NUMBER:
AGE:
MARITAL STATUS:
SEX:
NAME OF BANK(S):

Feel free to ask any questions.

Emily.

Kathie M Thomas

Beware the fake LinkedIn connection emails

Beware of job scams

About

Payment Information

Connect With Us

Newsletter

Thank you!

About

Payment Information

Connect With Us