Bill payment canceled phishing spam email

I received a spam email this morning, with the subject, Bill payment canceled. UK readers probably spotted it as spam right away, as the Americans spell cancelled, “canceled”, but just in-case anyone is checking if they have had a bill payment cancelled, here are the details:

Email subject: Bill payment canceled
From Ronald Crown [ronald.crown@nacha.org]
Attachment: report 837749598.pdf.zip (24 KB)

The ACH transfer (ID: 59284589009450), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Please  download the attachment(transfer report pdf).

If you have any questions please contact us at info@nacha.org.

Thank you for using http://www.nacha.org/.

Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA

3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489

If you receive the same or similar phishing Bill payment canceled email from Ronald Crown, or anyone else, first of all delete it without opening anything and then, if you have two minutes, send us a comment if there are any different details in your email. Thanks.

49 Responses to “Bill payment canceled phishing spam email”

Jan Nijmeijer Says:

I’ve got exactly the same email, also I got email about traffic tickets in the US while I live in Europe and visited the US in 2004 for the last time

K Says:

i got this today:

From: “Robert Dobs”
Date: August 3, 2011 2:13:30 AM EDT
To:
Subject: Bill payment canceled

The ACH transfer (ID: 59284589096507), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Please download the attachment(transfer report pdf).

If you have any questions please contact us at info@ nacha.org.
Thank you for using nacha.org.

Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA

3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489

paul Says:

The ACH transfer (ID: 59284589005458), recently initiated from your bank
account, was canceled by The Electronic Payments Association (NACHA).

Blah, blah, blah………………..

Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA

3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489

The attachment is a .zip file disguised as a .pdf file format, probably a .exe auto run program. (bad) glad I’m not on a PC.

Art Spery Says:

Got the same email…different “sender” and “ID”

DATE:
11/14/11 10:09 AM [ Full Screen ] [ SIZE: 34.939KB ]
Add To Address Book Add To White List FROM: Nicole Jackson
Add To Address Book Add To White ListTO:
SUBJECT: SPAM[3] -> Bill payment canceled
ATTACH: report_837749598.pdf.zip

The ACH transfer (ID: 59284589023472), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Please download the attachment(transfer report pdf).

If you have any questions please contact us at info@ nacha.org.
Thank you for using nacha.org.

Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA

3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489

I notice it is from Nicole Jackson, but signed Patrick Wilson - quality spam, eh? :) BM

Mike Says:

Same email also from Nicole Jackson

M D Says:

I received an email identical to the above except it came from nicole jackson at nacha.org and the ID was number was different - 59284589003230.

I live in California and received this today although the date sent was August 2, 2011 11:16:39 PM PDT

Bob Says:

For some reason I get a lot from this company which I delete immediately Sometimes I get several in one day. Here is a copy of one I just received:

The ACH transfer (ID: 59284589063432), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Rest of details, as above.

Chris Says:

I received the same email this morning from Nicole Jackson (nicole.jackson@nacha.org); body of the email is found below.

The ACH transfer (ID: 59284589047210), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Please download the attachment(transfer report pdf).

If you have any questions please contact us at info@ nacha.org.
Thank you for using nacha.org.

Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA

3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489

Beth Says:

I received this email today from Robert Dobs. Thank you for posting this - has anyone called the 703 phone number to let them know?

Joe Blowjo Says:

From: Robert Dobs
Subject: Bill payment canceled
Date: August 3, 2011 2:45:01 AM ADT

The ACH transfer (ID: 59284589052161), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

blah, blah…………

No need to be scared of leaving your name Mr Blojo, nobody reading this knows who you are) There are a lot of Michaels around…. :) BM

jule Says:

I received the same email as well as traffice tickets in NY, i AM IN TORONTO. Anyways, I figured it out right away.
Suckers.

Robert Says:

I am so sick of getting these! I get 3 -4 of them a day and its effecting my business. I do regular bank transfers and it freaks me out every time this pops up. Does anyone have any suggestions on how to stop them! I’m interested in how 4 spam emails coming in is effecting your business, Robert. Just delete them and move on with your day. Don’t worry, life is far too short. :) BM

Pjiotr (Netherlands) Says:

I got this at 4.53 PM local time today:

The ACH transfer (ID: 59284589003636), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Please download the attachment(transfer report pdf).

Patrick Wilson blah blah.

Darrell Says:

The ACH transfer (ID: 59284589098167), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Patrick Wilson blah blah…

steve Says:

My was exactly the same, but different ID:######. Since the ID numbers are different, maybe this is legit! JK Thanks for the posting Really? Do you really think that? :)

Patrick Says:

I got it too this morning. 11/15/11

The ACH transfer (ID: 59284589007270), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Patrick Wilson
blah blah…………

L Says:

I got the same one!!

SEO New York Says:

For some reason I get a lot from this company which I delete immediately Sometimes I get several in one day. Here is a copy of one I just received:

The ACH transfer (ID: 59284589063432), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Whitney Dix Says:

I have the same email…..but I opened it because it came to my school account and I live in the states…… It came from samuel.anderson@Nacha.org but says Patrick Wilson in the email

The ACH transfer (ID: 59284589092341), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Patrick Wilson
blah, blah………

steve allen Says:

got an email from Northern Rock building society (UK) requesting info, apparently it has come from ” Samuel.anderson@ Nacha.org !
Phishing !

Lilian Driessen Says:

I’ve received the same mail from Robert Dobs, I live in the Netherlands and don’t pay bills in the states.
The letter was also signed Patrick Wilson ( does excist he’s an actor)

Arty Says:

I received this email from Samuel Anderson

I found this weird because it was on my UK University email which I don’t share with any website so I haven’t a clue how I got it!!

JP Says:

I got this email from them today…

————–

Attn: Financial Department

We regret to inform you, that your most recent Direct Deposit via ACH payment (Int. No.994293980183) was rejected, because your business software package was out of date. The detailed information about this matter is available in the secure section of our web site:

varshiniproperties.com/3f034d/index.html

Please apply to your financial institution to obtain the necessary updates of the Direct Deposit software.

Best regards,

ACH Network Rules Department
NACHA | The Electronic Payments Association

13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
Phone: 703-561-1100 Fax: 703-787-0996

bob Says:

I get these all the time, often several each day. It does not cause problems as I know it is just a scam and are immediately deleted. Is there no way anybody can locate the source of these emails? Would be nice if the person responsible can be found so someone can put a .22 in the back of their skull! Really? Shoot someone in the head for sending an unwanted email?

Terrie Jo Says:

I got the exact same e-mail from “Patrick Wilson”. I didn’t open or download anything. I used copy/paste to put the phone number in my web browser which brought me to this web site. I deleted the message right away. Thanks for providing this information. You are most welcome, Terrie Jo, have a mighty fine day, BM

Stacy Says:

This is the second time I received one of these:

——-Original Message——-
From: The Electronic Payments Association
To:
Subject: ACH transfer rejected
Sent: 25 Nov ‘11 05:20

The ACH transfer (ID: 464373483745) recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Please download the attachment (transfer report pdf).
Download report 25.11.pdf.zip

If you have any questions please contact us at info @nacha.org.
Thank you for using nacha.org.

Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA

3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489

Stacy Says:

Oh - and I called my credit union, who said no suspicious activity has been noted on my account.

I also called the number to the supposed “NACHA” in the email, and it goes to a Verizon phone number, with an automated message that says “The number you dialed has been changed, disconnected, or is no longer in service. If you feel you have reached this recording in error, please check the number and try your call again….”

I then called the number on the NACHA website, 703-561-1100, and listened to a message from them saying the email is fraudulent, and that the attachment is a virus.

pamvdn Says:

For now I received the same mail as you have (4 times), this after I tryed to pay something.
I called my bank and there were no suspicious things going on on my account.
The mails I did forward to them.

Greg Says:

November 28, 2011
Owner/Manager
RE: Case # 55673368 Samuel O\’Neal

The Better Business Bureau has received the above-referenced complaint from one of your customers regarding their dealings with you. The details of the consumer\’s concern are included on the reverse. Please review this matter and advise us of your position.

As a neutral third party, the Better Business Bureau can help to resolve the matter. Often complaints are a result of misunderstandings a company wants to know about and correct.

In the interest of time and good customer relations, please provide the BBB with written verification of your position in this matter by December 02, 2011 . Your prompt response will allow BBB to be of service to you and your customer in reaching a mutually agreeable resolution. Please inform us if you have contacted your customer directly and already resolved this matter.

The Better Business Bureau develops and maintains Reliability Reports on companies across the United States and Canada . This information is available to the public and is frequently used by potential customers. Your cooperation in responding to this complaint becomes a permanent part of your file with the Better Business Bureau. Failure to promptly give attention to this matter may be reflected in the report we give to consumers about your company.

We encourage you to use our ONLINE COMPLAINT system to respond this complaint. The following URL (website address) below will take you directly to this complaint and you will be able to enter your response directly on our website: This would appear to be another phishing scam email, but nothing to do with the subject of the article. BM

K Says:

“From: Harold Zamora

This notice concerns the ACH transfer (ID: 81088426524) that
was recently sent from your account.

The current status of the referred transfer is: failed due to
the system malfunctioning. Please check the report below to learn
more:

[link, allegedly to bisonbuy.com]

Yours faithfully,
Harold Zamora
2011 NACHA - The Electronic Payments Association
13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171″

No attachment - I’m assuming a fraudulent link with virus on site.

I’m oddly amused by the email address used to send the spam. How very legit looking.
What does concern me is that they reached my private email rather than the one I use for online transactions. Unfortunatley, you only have to use your email once, for these scammers to find it. Either online, or sending to a friend, whom they can drop a piece of malware into their machine, with an email similar to the one you have recieved and scrape all the addresses that they have received an email from, or written an email to. No email address is completely hidden from these people. BM

Michael P Says:

I recieved the following email,

From: The Electronic Payments Association [mailto:info@ nacha.org]
Sent: Thursday, December 15, 2011 4:49 AM
To: xxhunter@ q.com
Subject: [Norton AntiSpam]ACH transaction suspended

The ACH transaction (ID: 82064125681392), recently sent from your bank account (by you or any other person), was canceled by the Electronic Payments Association.
Rejected transaction
Transaction ID: 82064125681392
Rejection Reason See details in the report below
Transaction Report report_82064125681392.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100
© 2011 NACHA - The Electronic Payments Association

Don’t really understand how it wound up in my “inbox” (originally tagged as SPAM by Norton’s spam filter for MS Outlook) as the email address it says it was sent to, “xxhunter@Q” while close to the address I often use, isn’t my email address. I’ve been reluctant to opent the transaction report link - so I don’t know what that document says. Googled for, and search the NACHA site to see if there was any provision for reporting or asking about phishing using their bona fides, but did not see anything to do so.

Michael P Says:

Took me a moment to find it, but FWIW anyone recieveing these phishing NACHA spam emails might want to forward a copy to abuse@ nacha.org.

Richard C Says:

To xxx@ hotmail.com
From: Richardcallan (acooper@ ehousemedia.com)

Same message as described above. I also will send this to the Commonwealth of VA Attorney General as it is in their state.

Beverly S. Says:

Details showed the email was sent to a lot of variant spellings of my name.

The ACH transaction (ID: 740100262620), recently sent from your checking account (by you or any other person), was canceled by the Electronic Payments Association.

Canceled transfer
Transaction ID: 740100262620
Reason for rejection See details in the report below
Transaction Report report_740100262620.do c (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100

© 2011 NACHA - The Electronic Payments Association

Colin Allinson Says:

Similar one (but less detail and no attachment - maybe stripped off by my email provider).

The ACH transaction (ID: 8438244421005), recently sent from your bank account (by you or any other person), was canceled by the Electronic Payments Association.

Rejected transfer
Transaction ID: 8438244421005
Reason of rejection See details in the report below
Transaction Report report_8438244421005.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171

2011 NACHA - The Electronic Payments Association

milen Says:

I got roughly the same thing, but the funny thing is the link leads to a part of quemonono.com, which is a bizarre, yet innocent-looking site =D Clicking on the link may have downloaded malware into your machine. I can’t say for certain, but it’s worth running a virus scan just in case :) BM

Tom G Says:

I got this email today, Contents were:

The ACH transaction (ID: 839370646156), recently initiated from your checking account (by you or any other person), was rejected by the Electronic Payments Association.
Canceled transfer
Transaction ID: 839370646156
Reason for rejection See details in the report below
Transaction Report report_839370646156.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
2011 NACHA - The Electronic Payments Association

Mark A Says:

The version I got today was this:

The ACH transaction (ID: 7594411361655), recently sent from your checking account (by you or any other person), was rejected by the Electronic Payments Association.

Rejected transfer
Transaction ID: 7594411361655
Reason for rejection See details in the report below
Transaction Report report_7594411361655.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
2011 NACHA - The Electronic Payments Association

The link for the “transaction report” is:
mancinelliefalconi.gov.it/983oXPvx/index.html

Bobbie Wren Says:

I received an email from The Electronic Payments Assocation when I clicked on the name it is terryjackson256@ bellsouth.net.
It states ACH Transfer erro
Dear Customer,
Regretfully we have to inform you, that Direct Deposit (#ACH345330434281US) has not been credited, becuse of discontined receipient account.
they are asking for correct banking information
2012 NACHA out of 13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171 (703) 561-1100

Who are these people?? How can these people take our hard earned money?? There are so many scams out there who do you know who you can trust? That’s why I post these articles. Thanks for contributing. BM

Greg Monks Says:

My link led to this website, originating in China:

characterfirst.com.cn/acinfo.html

needless to say I didn’t follow it!

Eric Waters Says:

I received this phishing email in the UK today:

The ACH transaction (ID: 131814796716), recently sent from your checking account (by you or any other person), was canceled by the Electronic Payments Association.

Canceled transaction
Transaction ID: 131814796716
Rejection Reason See details in the report below
Transaction Report report_131814796716.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171

2011 NACHA - The Electronic Payments Association

Meerna Says:

This is the e-mail that I got today, I did report it to our IT people as it came to my work e-mail.

The ACH transfer (ID: 44C31E9E4B96), recently initiated from your checking account (by you or any other person), was rejected by the other financial institution.
Transaction ID: 44C31E9E4B96
Reason for rejection See details in the report below
Transaction Report 44C31E9E4B96.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100

© 2011 NACHA - The Electronic Payments Association

A Jenner Says:

Had the same today 8th November just different numbers.
This is so blatant - is there no way to slap these SOB’s back ?
Preferable in their pocket. Also, as there have been so many, why cannot the ISP’s accept some responsibility and they sure as hell have enough financial resources to name. shame and hit them hard. Unfortunately, there is nothing you can do about it. Just delete the email, block the address and move on with your day :)

Roland F. Says:

Get this mail today in germany.

[Norton AntiSpam]ACH transaction (ID: 4AD190CAD1C) was rejected

Rejected transfer
The ACH transaction (ID: 4AD190CAD1C), recently initiated from your bank account (by you or any other person), was canceled by the other financial institution.

Transaction ID: 4AD190CAD1C
Reason of rejection See details in the report below
Transaction Report ACH_Report-4AD190CAD1C.pdf (Adobe Reader PDF)

13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100
© 2011 NACHA - The Electronic Payments Association

ACH_Report-4AD190CAD1C.pdf.zip(179 B)

Allen Bailey Says:

I got 2 of these e-mails from NACHA I looked up the IP adress, It’s somewhere close to Warsaw Poland.

Jeanne Says:

Here is what I received today Nov 10, 2012
NACHA
Rejected transfer
The ACH transfer (ID: CA38F346F3), recently sent from your checking account (by you or any other person), was canceled by the Electronic Payments Association.

Transaction ID: CA38F346F3
Reason of rejection See details in the report below
Transaction Report ACH_Report-CA38F346F3.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100

© 2011 NACHA - The Electronic Payments Association
1 Attached file| 63KB

ACH_Report-CA38F346F3.doc.zip

Download

Chris Says:

I have received 3 emails like this

We are sorry to inform you, that your most recent Direct Deposit transaction (IN837594118319) was disallowed, because your current Direct Deposit software version was out of date. The detailed information about this matter is available in the secure section of our web site:

Details

Please consult with your financial institution to get the updated version of the software.

Yours truly,

ACH Network Rules Department
NACHA | The Electronic Payments Association

12388 Sunrise Valley Drive, Suite 199
Herndon, VA 20387
Phone: 703-145-9612 Fax: 703-519-6507

Felix Boen Says:

And here is another one:

Herewith we are informing you, that your latest Direct Deposit transaction (ID496210841884) was cancelled, due to your business software package being out of date. The details regarding this matter are available in our secure section::

Details

Please apply to your financial institution to get your updated version of the software needed.

Yours truly,

ACH Network Rules Department
NACHA | The Electronic Payments Association

16845 Sunrise Valley Drive, Suite 387
Herndon, VA 22274
Phone: 703-324-2551 Fax: 703-980-9052

Mike Says:

My company emails across the board are now getting these daily!

Does anyone know how to get rid of them completely, we all immeadiately move them to junk and block sender, however the next day its the same stuff coming from new email addresses?

We are sorry to notify you, that your latest Direct Deposit via ACH payment (No.526446639819) was disallowed, because of your current Direct Deposit software being out of date. Please use the link below to enter the secure section of our web site and see the details::

Details

Please consult with your financial institution to obtain the new version of the software.

Sincerely yours

ACH Network Rules Department
NACHA | The Electronic Payments Association

10528 Sunrise Valley Drive, Suite 987
Herndon, VA 27366
Phone: 703-707-1868 Fax: 703-773-2429

Leave a Reply





SEO Blog

SEO Blog

The Big Man's SEO blog is primarily aimed at website owners looking for ethical SEO tips, optimisation advice and who are interested in reading articles and opinions related to search engines, the internet, technology and software.