Crooks Commandeer Sam's Club Name to Send Scam Emails

Large-scale scourge

This phishing email — not actually from Sam’s Club — was sent to an AARP member in October. Experts say hundreds of brands are featured in scam emails like these, and they should be deleted.

AARP

Sam’s Club has 599 stores in 44 states and Puerto Rico, its corporate parent, Walmart, stated in its last annual report. Sam’s Club has seen no indication that its computer systems have been infiltrated or that it suffered a data breach, according to Hulliberger. When the company contacts consumers, it never asks for a credit card number, so consumers should not reveal theirs, she added. 

The top methods of contact in frauds reported to the FTC in recent years have been, in descending order, phone calls, texts and emails. Though in third place, illicit emails trigger big losses: $149 million during the first half of 2021, which put losses on pace to exceed the $252 million lost in all of 2020 and $226 million in 2019.

After the record-setting number of brand attacks in May, the number dipped to 495 in June, the Cambridge, Massachusetts–based APWG stated in a recent report. Meantime, in June, 222,127 unique phishing websites were reported, along with 9,669 unique phishing email subject lines, the consortium said.

The APWG has members from governments, law enforcement and other entities in about 140 countries, but most of its phishing reports come from the U.S., said Peter Cassidy, its cofounder and secretary-general.

Be vigilant as holidays near

The upcoming holidays require vigilance, since the pandemic has triggered a huge uptick in e-commerce, Cassidy said. COVID-19 has conditioned consumers to be comfortable with online retail and digital payments, so “phishing gangs will be using that comfort and familiarity to their advantage.”

Addressing the phishing emails purportedly from Sam’s Club, Cassidy said that on their face, they were unremarkable — the “same old, same old” pitches that have long bedeviled consumers. Phished “Sam’s Club” emails don’t seem to be among cybercrooks’ “perennial favorites,” he added.

Still, it’s what happens when you respond to a phishing email that causes problems, Cassidy warned. Does a fraudster in a follow-up call try to wheedle information out of you? Does a link take you to a malicious website?

The anti-phishing group warns that technical subterfuge can play a role in phishing attacks, as bad actors try to plant malicious software onto computer devices to steal consumers' credentials. Often they misdirect consumers to counterfeit websites to intercept sensitive information.

Financial institutions are top target

National brands are vulnerable because they are known and trusted, Cassidy said. Financial institutions were the hardest-hit sector, the target of 29 percent of phishing attacks from April through June of this year, according to the APWG. Rounding out the top five sectors were social media sites (15 percent of attacks), digital-payment sites (12 percent), email and cloud-based software service providers (9 percent), and retail and e-commerce sites (8 percent).

Also worrisome is that the cryptocurrency industry, including exchanges and wallet providers, was the sixth-most-often-hit sector, the target of 7.5 percent of attacks in the second quarter of the year (up from 2 percent in the first quarter).

Observing that cybercrime ignores country borders, Cassidy said gangs across the world can easily obtain huge lists of emails, steal company logos and masquerade as legit businesses.

So, remember, if you are asked in a questionable email to take a survey or click a link, do not, Cassidy stressed. No purported reward or prize is worth the trouble that could result. Likewise, delete emails from entities that you do business with but that do not normally reach out in electronic messages. Instead, contact the company through a secure method, like a phone number from a statement, to investigate what’s been presented.

“Be thoughtful about every inbound communication,” Cassidy said. “The most effective email attacks are against people who are really customers of an organization or a company.”

As for the phishing emails supposedly from Sam’s Club, the recipients aren’t members. And, no, they didn’t engage. Instead, they unleashed a not-so-secret weapon: the delete key.

AARP’s Fraud Watch Network can help you spot and avoid scams. Sign up for free Watchdog Alerts, review our scam-tracking map, or call our toll-free fraud helpline at 877-908-3360 if you or a loved one suspect you’ve been a victim.