Suspicious email with my information in it: what do i do?

Question

I just received this email:

Billed To:
d**********@****.NET

John ******

Order Number: M1V62***2711
Receipt Date: 07/12/12
Order Total: $699.99
Billed To: Credit card

Item Number     Description     Unit Price
1               Postcard (View\Download ) 
Cancel order   Not your order?Report a Problem  $699.99

Subtotal:   $699.99
Tax:    $0.00

Order Total:    $699.99

Please retain for your records.
Please See Below For Terms And Conditions Pertaining To This Order.

Apple Inc.
You can find the iTunes Store Terms of Sale and Sales Policies by launching your iTunes   application and clicking on Terms of Sale or Sales Policies

Answers to frequently asked questions regarding the iTunes Store can be found at http://www.apple.com/support/itunes/store/

Apple ID Summary •  Detailed invoice

Apple respects your privacy.

Copyright © 2011 Apple Inc. All rights reserved

I removed some characters of course to protect my information. Heres the thing, i don't use a credit card for my iTunes, i ALWAYS just buy gift cards and use it that way. It has all of the logos and images usually associated with an apple email. The sender is [email protected] my question is: is this a legitimate email or if i click on the links am i probably going to get taken for a ride? The thing is is that this email isn't even associated with my iTunes account, this is my work email. Whats the deal?

if this question is not on topic here, I'm fine with it getting migrated, I've never posted a question here and I'm not sure if it is within the scope of the site.

EDIT

I checked all of the links on the page and they all go to here: tomjames.comcastbiz.net/check.php

---

I contacted Apple support and this is what i got back:

John, many customers have recently reported they received a similar email. I'll be glad to provide as much information as I can. I've looked into this for you and found that neither the email nor its sender are affiliated with Apple. The email appears to be a phishing attempt, designed to trick users into visiting a website. Fortunately, the purchase indicated in the email is not a real charge. I've checked your account to be certain.

Answer 1

As your edit shows, this was a phishing attempt by someone who controls:

tomjames.comcastbiz.net/check.php

Relax. They do not have your secret details (unless of course you went to their site and gave them more information) besides your name and email which probably isn't secret information. You do not have to do anything. You potentially could report the link to some anti-phishing sites or your email provider if you want; but sometimes its best to just ignore it.

http://www.us-cert.gov/nav/report_phishing.html

http://www.google.com/safebrowsing/report_phish/

Answer 2

Make sure you don't panic. Many phishing e-mails look authentic but are not. Your personal details might have been harvested from any number of places on the internet, so don't automatically assume that your identity has been stolen and do something rash.

This looks like a tell-tale phishing e-mail to me, and my best guess without seeing the links is that they'll lead you to a malicious website attempting to harvest your Apple ID. Don't click on them!

1. Call your credit card company and make them aware of the situation. They can then decide the course of action as to whether or not they think there is a threat and act accordingly. This is a mitigation step, and will help you rest easy at night.
2. As liviu pointed out, there are a few items in e-mail that would make me believe it was fake. You should check the headers of the e-mail and look it up in an Whois database to see who the IP is registered to.
3. It should be noted that SMTP, by nature, is not a very secure protocol in that "from" addresses can easily be spoofed to claim that they are coming from someone that they are not. Do an IP Whois lookup on the header from the e-mail and that will help determine where the email actually came from.
4. Contacting Apple may be worth while as well - if for no other reason that to simply make them aware that this is happening.

EDIT (in relation to question edit) : I would say it's unlikely that this e-mail contained a malicious payload, though not impossible. The attack vector here looks to be a link to a page designed to harvest your Apple ID information. If it makes you breathe easier, feel free to run a virus scan to ensure your computer is clean.

Answer 3

• You can check where the link mentioned points (hover over the link, or copy the link address), and see if it's where it says.

  • Check the email headers and trace the sender (sender tracking)

  • if it's your work email, does it have both name and surname in it?

Also some signs it may be something wrong:

• the year is 2011 in the copyright message
• the Russian characters.

You said you suspected it's not right, when in doubt,..., better err on the cautious side.

As already advised, don't panic. This is one of the motivators exploited in those kinds of phishing email, to induce fear ("send this email to another 20 people or something bad will happen", "500$ have just been extracted from your account", curiosity - "see my summer vacation pics"..)