616-855-6731

This is a fax machine used in a phishing scheme.  An email came in that read:


Microsoft Mail Internet Headers Version 2.0
Received: from mail.tshore.com ([10.0.4.129]) by xxxxxxxx.com with Microsoft SMTPSVC(6.0.3790.4675);
     Fri, 9 Jul 2010 11:13:26 -0400
Received: from fwd1k.spamh.com ([174.36.242.xx]) by mail.xxx.com with Microsoft SMTPSVC(5.0.2195.6713);
     Fri, 9 Jul 2010 11:13:25 -0400
Received: from d31.spamh.com (d31.spamh.com [174.37.82.36])
    by fwd1k.spamh.com (8.14.2/8.14.2) with ESMTP id o69FDP3t019574
    (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK)
    for <steveb@tshore.com>; Fri, 9 Jul 2010 11:13:25 -0400
Received: from holmes.peterlink.ru ([10.10.103.198])
    by d31.spamh.com (8.14.2/8.14.2) with ESMTP id o69FDMpN031034
    for <xxxxx@xxxx.xxx>; Fri, 9 Jul 2010 11:13:23 -0400
Message-Id: <201007091513.o69FDMpN031034@d31.spamh.com>
Received: from barrymore.peterlink.ru (barrymore.peterlink.ru [195.242.2.8])
    by holmes.peterlink.ru (8.12.6/8.12.6) with ESMTP id o69FCj2P054494;
    Fri, 9 Jul 2010 19:12:45 +0400 (MSD)
Received: from rogach.peterlink.ru (rogach.peterlink.ru [195.242.2.17])
    by barrymore.peterlink.ru (8.9.1/8.9.1) with ESMTP id TAA28122; Fri, 9 Jul 2010 19:12:45 +0400 (MSD)
Received: from netserver (gw-ems2.countrycom.spb.ru [62.16.102.182] (may be forged))
    (authid=po4sides)
    by rogach.peterlink.ru (8.13.8/8.13.8) with ESMTP id o69FCeab085474;
    Fri, 9 Jul 2010 19:12:41 +0400 (MSD)
Received: from User ([212.11.174.130])
    (authenticated user anna@4sides.spb.ru)
    by netserver (Kerio MailServer 6.0.5);
    Fri, 9 Jul 2010 19:16:17 +0400
From: "Visa"<support@visa.com>
Subject: [Foreign Sender] Visa Card blocked. Confirm your identity.
Date: Fri, 9 Jul 2010 18:12:32 +0300
MIME-Version: 1.0
Content-Type: text/plain;
    charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-SpamH-CheckIP: 195.242.2.2
X-SpamH-Recipient: steveb@tshore.com
X-SpamH-ID: d31.spamh.com-o69FDMpN031034
X-SpamH-Action: MODIFY SUBJECT
X-SpamH-IP-Blacklist: IP Blacklisted in region 11
X-SpamH-Debug: 195.242.2.2
X-SpamH-Quarantine: End user QUARANTINE
X-SpamH-Filtered: Yes
Bcc:
Return-Path: support@visa.com
X-OriginalArrivalTime: 09 Jul 2010 15:13:25.0988 (UTC) FILETIME=[476ADA40:01CB1F79]
Dear Visa® customer,

It has come to our attention that your Visa Card has been involved in a fraudulent auction in Miami, Florida on the date of July 01, 2010 As a result we started an investigation and your credit card has been blocked. You will not be able to use your visa card again until we will verify your identity. Information needs to be reactivated as part of our continuing commitment to protect your card and to reduce the instance of fraud. Once you have reactivated your Visa Card records, your card service will not be interrupted and will continue as normal.

Your Case ID Number is: FR78ERW7RTY4

To reactivate your Visa Card we need the following documents to be sent by fax at: +1 (616) 855-6731

- copy of your driver's license
- copy of the front of your credit card
- a document containing the following details:
    1. Card Number
    2. Expiration Date
    3. CVV2(3 digits number on the back of your credit card)
    4. Name on Card
    5. Social Security Number
    6. Date Of Birth
    7. Mother's Maiden Name
    8. Street Address
    9. City
   10. State
   11. Zip/Postal Code
   12. Country
   13. Phone Number
   14. Email Attached To Your Visa Card
   15. Security Key



Failure to verify your records will result in Card suspension.

Accounts Management As outlined in our User Agreement, Visa will periodically send you information about site changes and enhancements.

Please note:
This message was automatically generated. Please do not answer this email.

If you have any questions regarding the result of this request please do always include the following order number: #FR78ERW7RTY4

I got the same email message. BEWARE!

Just received the same message in an email.  VISA would not ask for such sensitive information in an email, or to send it to a fax machine.

Do not reply!!

I got the same "scam" E-mail, from St. Petersburg (RUSSIA), with headers:

Received: from holmes.peterlink.ru (holmes.peterlink.ru [195.242.2.2])  Fri, 9 Jul 2010 15:13:15 -0700
Received: from barrymore.peterlink.ru (barrymore.peterlink.ru [195.242.2.8])
    by holmes.peterlink.ru (8.12.6/8.12.6) with ESMTP id o696o02P010399;    Fri, 9
Jul 2010 10:50:00 +0400 (MSD)
Received: from rogach.peterlink.ru (rogach.peterlink.ru [195.242.2.17])    by
barrymore.peterlink.ru (8.9.1/8.9.1) with ESMTP id KAA16512; Fri, 9 Jul 2010
10:50:00 +0400 (MSD)
Received: from netserver (gw-ems2.countrycom.spb.ru [62.16.102.182] (may be
forged))    (authid=po4sides)    by rogach.peterlink.ru (8.13.8/8.13.8) with ESMTP
id o696nu67071525;    Fri, 9 Jul 2010 10:49:57 +0400 (MSD)
Received: from User ([212.11.174.130])    (authenticated user anna@4sides.spb.ru)
    by netserver (Kerio MailServer 6.0.5);    Fri, 9 Jul 2010 10:53:33 +0400
From: Visa <support@visa.com>
Subject: Visa Card blocked. Confirm your identity.
Date: Fri, 9 Jul 2010 09:49:47 +0300
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
To: Undisclosed recipients:;
Return-Path: support@visa.com
-------------

Yeah, right, that the 'TO:' field implies that many people received the same E-mail.

Scam, scam, scam.