Another Trezor Scam Attempt!

[Pablo-wood]

...

Scammers seems to have one common language, they always claim there is critical vulnerability or urgent updates making people feel it is a secure update and people with little or no experience about phishing links just fall for this.

Email was sent from interesting address:

Code:

info@car.com.au

This doesn't look official at all. The scammer is still a learner. Maybe the Idea was to try out something new he or she learnt.

[uchegod-21]

Beware everyone, here goes another fake Trezor emails sent by scammers!
This time they are claiming some vulnerability and patch needed for critical secure update, but that is malware so don't click or download anything.
Email was sent from interesting address:

Code:

info@car.com.au

SCAM!

Mere looking at  this email, I could spot the error in the mail. Any experienced person can easily spot this, but the concern is on newbies. There is more to investing in crypto than just making profits from it. Newbies are usually the main targets because of their poor knowledge of crypto and wallet security.

This is why I will advice those investors and traders who are already in the system to always let newbies they mentor know these things. Many newbies are scared of volatility and losing their private keys, they don't know that having to deal with scammers is the worst of it all. Everything they worked hard for can vanish in the twinkle of an eye.

[dkbit98]

I again received a bunch of SCAM trezor emails again, and all coming from different addresses.
I saved content of this messages, and this could be a good learning example for new members.
All emails had Trezor or Satoshi Labs in title, but coming from different sources.
NEVER click on any links or buttons!

   

[$crypto$]

Beware everyone, here goes another fake Trezor emails sent by scammers!
This time they are claiming some vulnerability and patch needed for critical secure update, but that is malware so don't click or download anything.
Email was sent from interesting address:

Code:

info@car.com.au

SCAM!

Today I received a fake email from Trezor with a different message text.
With them saying this protocol security advice from Trezor is just a hoax.
So you have to be vigilant sometimes emails like this come several times.

Code:

noreply@gant.com

[PX-Z]

Today I received a fake email from Trezor with a different message text.
With them saying this protocol security advice from Trezor is just a hoax.
So you have to be vigilant sometimes emails like this come several times.

Any hardware wallet update sent via email should automatically be treated as spam or a scam attempt. Updates should never be delivered this way, as it's a common tactic used by hackers to lure users into downloading malicious software or revealing their recovery phrases. Always update your hardware wallet only through the official app or website, and double-check URLs for authenticity.

[Nwada001]

I again received a bunch of SCAM trezor emails again, and all coming from different addresses.

This mail could either just be coming from one person or a group of persons who have your mail address and that of others, and they have just been loading them with different types of scam mail using the same method but with different content just for it to pass the email spam filter and land in the inbox. I think your old mail might have been exposed somehow, just like my old mail, which is a bedroom for scam/spam mail.

[Potato Chips]

These scammers have spammed my old email as well lol.

I think mine started on June. Thankfully, it appears they have slowed down on my end as it wasn't as often as before. I see recent ones straight to my spam folder too which help the annoyance up to a certain extent.

It's the classic incite a sense of urgency tactic, hence the "security incident"

I just checked the email I used to order trezor HW years ago, and found I've been getting spammed LOL. I looked into it, and they're all scams that request folks to install malicious firmware updates as well.

I'd say at some point, everyone will encounter malicious emails. So one way or another, we gotta learn how to separate genuine from scams. All these reference threads about it should come in handy.

[Kelward]

...

Scammers seems to have one common language, they always claim there is critical vulnerability or urgent updates making people feel it is a secure update and people with little or no experience about phishing links just fall for this.

Email was sent from interesting address:

Code:

info@car.com.au

This doesn't look official at all. The scammer is still a learner. Maybe the Idea was to try out something new he or she learnt.

This is true, scammers always gives the impression that they want to do something important for you own good and it is in your best interest to follow their directives. Everybody needs to be constantly informed about how these scammers operate because they always invade people's privacies impersonating genuine sources, anybody that is not well informed will easily become their victims. Cases of scams and hacks are on the increase and it is very alarming, we should always verify whatever that is sent to us before believing because clicking a link that you are not very certain about can lead you to being hacked and scammed.

[apogio]

Ok, I think it's getting way out of hand, isn't it? I am seriously tired of these scam attempts. I 've received 7 emails since July 31st.

List of emails (so that you can put them in your filter list before they reach you):

- trezor [at] unroyal [dot] com
- noreply [at] scramnetwork [dot] com
- no-reply [at] cashio[dot] net
- noreply [at] bumc [dot] net
- noreply [at] viscosityna [dot] net
- support [at] performitiv [dot] com
- noreply [at] lifebeyondlimits [dot] com [dot] au

[Alvin_talk]

The email address is such a big teller in this case, I wonder if there are actually people who can fall for a scam like this.

It always helps to stop, take a breath and think before you act. Acting in a haste will very likely lead you to make a mistake and can lead to losses.

- Jay -

Yes, you are correct the email is a big teller but if you are having a very busy day with so much activities and these scammers sends you an email you might just mistakenly click the link and the rest will be stories.

I think being alert and aware at all time is the only possible solution to this.

[Outhue]

I have two different hardware wallets and I've never received email about an update before, even if it's possible I won't go through the mail to update the devices, the official website is where the real answer lies. In this days you can't trust any email or messages online, even if the email looks like it's from official source it still can't be trusted, always verify on the official website, usually it's strange if they notify users via email for an update.

Mails are compromised when it comes to attacks, don't always complete a task through them because it can also be a inside job that looks like an attack among the team too, just because the email is from original source doesn't mean you should perform anything they asked you to, mainly when it's about your hardware wallet. There are many stupid scams online that I can never be a victim and this is one of them.

[dkbit98]

Ok, I think it's getting way out of hand, isn't it? I am seriously tired of these scam attempts. I 've received 7 emails since July 31st.

I received a bunch of this emails, but that was my test email address that is not connected with any of my personal information
It's better to use temp emails or dedicated email aliases to avoid or reduce getting bombarded with phishing scam emails.  
My suggestion is to avoid purchasing any hardware wallet online with your main email address, and it's even better if you can purchase it in physical store with cash or with BTC.

[apogio]

I received a bunch of this emails, but that was my test email address that is not connected with any of my personal information
It's better to use temp emails or dedicated email aliases to avoid or reduce getting bombarded with phishing scam emails.  
My suggestion is to avoid purchasing any hardware wallet online with your main email address, and it's even better if you can purchase it in physical store with cash or with BTC.

You are definitely right. I used an email that’s not my primary nor secondary but it’s one I use sometimes. But I should have used a one-time email for this purpose. Anyway, for the next time…

By the way, do we have any info about how they have scraped our emails?

[dkbit98]

By the way, do we have any info about how they have scraped our emails?

If I remember correctly Terzor email newsletter got hacked a while ago (they used third party partner), that is how they got most email addresses, but they don't have other personal information.
There could be other ways for them to get emails, especially if same address was used to anything related with crypto.

[NotATether]

Just block it in your /etc/hosts file (Windows users - it's located in a subfolder of System32 - Unfortunately I don't exactly remember which one, but it has a similar structure).

I'm sure the hosts file will fill up like this though, so maybe it would be time to run a Pi-hole and stop the phishing at the network layer.

[nakamura12]

I have noticed that there are many topics about hardware wallets are being used to steal or to scam people off of their crypto funds. I think it's what scammers used nowadays according to the topics about hardware wallet popping up. I think those who mostly use those wallets should be very careful about what they do to avoid something bad from happening and losing crypto that people have stored for quite some time.

[Ojima-ojo]

Today I received a fake email from Trezor with a different message text.
With them saying this protocol security advice from Trezor is just a hoax.
So you have to be vigilant sometimes emails like this come several times.

Any hardware wallet update sent via email should automatically be treated as spam or a scam attempt. Updates should never be delivered this way, as it's a common tactic used by hackers to lure users into downloading malicious software or revealing their recovery phrases. Always update your hardware wallet only through the official app or website, and double-check URLs for authenticity.

Right the thing is that for someone with a hardware wallet that doesn't need constant updates, the only secure option is to visit the official website and have the update done yourself.

Why the heck about anyone take email update seriously, when you did not request for it, between luckily that the mate is smart enough to notice and raise his concerns here.

[PX-Z]

Why the heck about anyone take email update seriously, when you did not request for it, between luckily that the mate is smart enough to notice and raise his concerns here.

Honestly speaking, there are still people get victimized on this regardless the warnings given of the platform or any anti-phishing campaign in the internet. Idk how these user (victims) minds works whenever they receive such emails. Even double checking the url of the site if its correct,  leads to confusions and unfortunately, end up losing its funds on those wallets or account.

[aoluain]

By the way, do we have any info about how they have scraped our emails?

If I remember correctly Terzor email newsletter got hacked a while ago (they used third party partner), that is how they got most email addresses, but they don't have other personal information.
There could be other ways for them to get emails, especially if same address was used to anything related with crypto.

If that was the case its really bad form on the part of Trezor. Their whole mantra
and business model is centred around security and privacy but in this case they
are happy to use a "third party". The biggst selling point of Trezor is to not use a
third party to store our coins and its precisely the reason we use their product
in the first place - to avoid using a third party. As a Trezor user I'm not impressed
and I cant understand how a tech company would have to use a outside service?


 

[KiaKia]

Word of warning to everyone who is using Trezor devices, watch out for new wave of scam attempts!
I just received email that I should update my Trezor and ''enhance my security with secure ease''.
Luckily I learned my lesson long timr ago and I don't click any links, even if they are legit, before I check them.

The thing is if you verify the email you will discover that that message is not from Trezor's official email also we need to be constantly on the lookout for phishing emails to I don't reply to emails if I don't request for it, to be at the safer side, a lot of time, many that fall for this kind of scam did not do their due diligence checks and their lack the knowledge to spot the red flags just like you did.


Thank you for bringing this up here!

The only way this scam can maybe be effective is if these scammers have the right email address of all people that actually own a trezor device, if I am sent this mail now I will just laugh it out because i never own any trezor device.

I saw similar trick but with Ledger hardware wallet and I don't own one either lol, this is the fastest way that these scammers are shooting themselves in the legs, they form email address and sent the messages out or maybe they have email filters but the fact remains, there is no way to know how really owns a Trezor device.

All this drama is about having common sense, to update the firmware of any hardware devices this days it has to be done via the official website, teams will never send you any clickable link through email.