Comments on: Bill payment canceled phishing spam email

By: Mike

Mike — Tue, 11 Dec 2012 22:59:00 +0000

My company emails across the board are now getting these daily!

Does anyone know how to get rid of them completely, we all immeadiately move them to junk and block sender, however the next day its the same stuff coming from new email addresses?

We are sorry to notify you, that your latest Direct Deposit via ACH payment (No.526446639819) was disallowed, because of your current Direct Deposit software being out of date. Please use the link below to enter the secure section of our web site and see the details::

Details

Please consult with your financial institution to obtain the new version of the software.

Sincerely yours

ACH Network Rules Department
NACHA | The Electronic Payments Association

10528 Sunrise Valley Drive, Suite 987
Herndon, VA 27366
Phone: 703-707-1868 Fax: 703-773-2429

By: Felix Boen

Felix Boen — Tue, 27 Nov 2012 15:01:56 +0000

And here is another one:

Herewith we are informing you, that your latest Direct Deposit transaction (ID496210841884) was cancelled, due to your business software package being out of date. The details regarding this matter are available in our secure section::

Details

Please apply to your financial institution to get your updated version of the software needed.

Yours truly,

ACH Network Rules Department
NACHA | The Electronic Payments Association

16845 Sunrise Valley Drive, Suite 387
Herndon, VA 22274
Phone: 703-324-2551 Fax: 703-980-9052

By: Chris

Chris — Tue, 13 Nov 2012 21:57:54 +0000

I have received 3 emails like this

We are sorry to inform you, that your most recent Direct Deposit transaction (IN837594118319) was disallowed, because your current Direct Deposit software version was out of date. The detailed information about this matter is available in the secure section of our web site:

Details

Please consult with your financial institution to get the updated version of the software.

Yours truly,

ACH Network Rules Department
NACHA | The Electronic Payments Association

12388 Sunrise Valley Drive, Suite 199
Herndon, VA 20387
Phone: 703-145-9612 Fax: 703-519-6507

By: Jeanne

Jeanne — Sat, 10 Nov 2012 06:07:49 +0000

Here is what I received today Nov 10, 2012
NACHA
Rejected transfer
The ACH transfer (ID: CA38F346F3), recently sent from your checking account (by you or any other person), was canceled by the Electronic Payments Association.

Transaction ID: CA38F346F3
Reason of rejection See details in the report below
Transaction Report ACH_Report-CA38F346F3.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100

ACH_Report-CA38F346F3.doc.zip

Download

By: Allen Bailey

Allen Bailey — Sat, 10 Nov 2012 00:58:36 +0000

I got 2 of these e-mails from NACHA I looked up the IP adress, It’s somewhere close to Warsaw Poland.

By: Roland F.

Roland F. — Fri, 09 Nov 2012 16:13:59 +0000

Get this mail today in germany.

[Norton AntiSpam]ACH transaction (ID: 4AD190CAD1C) was rejected

Rejected transfer
The ACH transaction (ID: 4AD190CAD1C), recently initiated from your bank account (by you or any other person), was canceled by the other financial institution.

Transaction ID: 4AD190CAD1C
Reason of rejection See details in the report below
Transaction Report ACH_Report-4AD190CAD1C.pdf (Adobe Reader PDF)

13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100
© 2011 NACHA - The Electronic Payments Association

ACH_Report-4AD190CAD1C.pdf.zip(179 B)

By: A Jenner

A Jenner — Thu, 08 Nov 2012 16:21:14 +0000

Had the same today 8th November just different numbers.
This is so blatant - is there no way to slap these SOB’s back ?
Preferable in their pocket. Also, as there have been so many, why cannot the ISP’s accept some responsibility and they sure as hell have enough financial resources to name. shame and hit them hard. Unfortunately, there is nothing you can do about it. Just delete the email, block the address and move on with your day

By: Meerna

Meerna — Thu, 08 Nov 2012 13:41:06 +0000

This is the e-mail that I got today, I did report it to our IT people as it came to my work e-mail.

The ACH transfer (ID: 44C31E9E4B96), recently initiated from your checking account (by you or any other person), was rejected by the other financial institution.
Transaction ID: 44C31E9E4B96
Reason for rejection See details in the report below
Transaction Report 44C31E9E4B96.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100

By: Eric Waters

Eric Waters — Thu, 05 Jul 2012 14:22:39 +0000

I received this phishing email in the UK today:

The ACH transaction (ID: 131814796716), recently sent from your checking account (by you or any other person), was canceled by the Electronic Payments Association.

Canceled transaction
Transaction ID: 131814796716
Rejection Reason See details in the report below
Transaction Report report_131814796716.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171

2011 NACHA - The Electronic Payments Association

By: Greg Monks

Greg Monks — Thu, 05 Jul 2012 14:01:36 +0000

My link led to this website, originating in China:

characterfirst.com.cn/acinfo.html

needless to say I didn’t follow it!

By: Bobbie Wren

Bobbie Wren — Wed, 29 Feb 2012 16:42:06 +0000

I received an email from The Electronic Payments Assocation when I clicked on the name it is terryjackson256@ bellsouth.net.
It states ACH Transfer erro
Dear Customer,
Regretfully we have to inform you, that Direct Deposit (#ACH345330434281US) has not been credited, becuse of discontined receipient account.
they are asking for correct banking information
2012 NACHA out of 13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171 (703) 561-1100

Who are these people?? How can these people take our hard earned money?? There are so many scams out there who do you know who you can trust? That’s why I post these articles. Thanks for contributing. BM

By: Mark A

Mark A — Mon, 30 Jan 2012 17:51:32 +0000

The version I got today was this:

The ACH transaction (ID: 7594411361655), recently sent from your checking account (by you or any other person), was rejected by the Electronic Payments Association.

Rejected transfer
Transaction ID: 7594411361655
Reason for rejection See details in the report below
Transaction Report report_7594411361655.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
2011 NACHA - The Electronic Payments Association

The link for the “transaction report” is:
mancinelliefalconi.gov.it/983oXPvx/index.html

By: Tom G

Tom G — Fri, 27 Jan 2012 16:37:01 +0000

I got this email today, Contents were:

The ACH transaction (ID: 839370646156), recently initiated from your checking account (by you or any other person), was rejected by the Electronic Payments Association.
Canceled transfer
Transaction ID: 839370646156
Reason for rejection See details in the report below
Transaction Report report_839370646156.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
2011 NACHA - The Electronic Payments Association

By: milen

milen — Fri, 27 Jan 2012 13:33:58 +0000

I got roughly the same thing, but the funny thing is the link leads to a part of quemonono.com, which is a bizarre, yet innocent-looking site =D Clicking on the link may have downloaded malware into your machine. I can’t say for certain, but it’s worth running a virus scan just in case BM

By: Colin Allinson

Colin Allinson — Fri, 27 Jan 2012 12:17:21 +0000

Similar one (but less detail and no attachment - maybe stripped off by my email provider).

The ACH transaction (ID: 8438244421005), recently sent from your bank account (by you or any other person), was canceled by the Electronic Payments Association.

Rejected transfer
Transaction ID: 8438244421005
Reason of rejection See details in the report below
Transaction Report report_8438244421005.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171

2011 NACHA - The Electronic Payments Association

By: Beverly S.

Beverly S. — Sat, 17 Dec 2011 14:49:14 +0000

Details showed the email was sent to a lot of variant spellings of my name.

The ACH transaction (ID: 740100262620), recently sent from your checking account (by you or any other person), was canceled by the Electronic Payments Association.

Canceled transfer
Transaction ID: 740100262620
Reason for rejection See details in the report below
Transaction Report report_740100262620.do c (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100

By: Richard C

Richard C — Sat, 17 Dec 2011 02:43:29 +0000

To xxx@ hotmail.com
From: Richardcallan (acooper@ ehousemedia.com)

Same message as described above. I also will send this to the Commonwealth of VA Attorney General as it is in their state.

By: Michael P

Michael P — Thu, 15 Dec 2011 19:50:22 +0000

Took me a moment to find it, but FWIW anyone recieveing these phishing NACHA spam emails might want to forward a copy to abuse@ nacha.org.

By: Michael P

Michael P — Thu, 15 Dec 2011 19:44:11 +0000

I recieved the following email,

From: The Electronic Payments Association [mailto:info@ nacha.org]
Sent: Thursday, December 15, 2011 4:49 AM
To: xxhunter@ q.com
Subject: [Norton AntiSpam]ACH transaction suspended

The ACH transaction (ID: 82064125681392), recently sent from your bank account (by you or any other person), was canceled by the Electronic Payments Association.
Rejected transaction
Transaction ID: 82064125681392
Rejection Reason See details in the report below
Transaction Report report_82064125681392.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100
© 2011 NACHA - The Electronic Payments Association

Don’t really understand how it wound up in my “inbox” (originally tagged as SPAM by Norton’s spam filter for MS Outlook) as the email address it says it was sent to, “xxhunter@Q” while close to the address I often use, isn’t my email address. I’ve been reluctant to opent the transaction report link - so I don’t know what that document says. Googled for, and search the NACHA site to see if there was any provision for reporting or asking about phishing using their bona fides, but did not see anything to do so.

By: K

Mon, 12 Dec 2011 17:50:30 +0000

“From: Harold Zamora

This notice concerns the ACH transfer (ID: 81088426524) that
was recently sent from your account.

The current status of the referred transfer is: failed due to
the system malfunctioning. Please check the report below to learn
more:

[link, allegedly to bisonbuy.com]

Yours faithfully,
Harold Zamora
2011 NACHA - The Electronic Payments Association
13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171″

No attachment - I’m assuming a fraudulent link with virus on site.

I’m oddly amused by the email address used to send the spam. How very legit looking.
What does concern me is that they reached my private email rather than the one I use for online transactions. Unfortunatley, you only have to use your email once, for these scammers to find it. Either online, or sending to a friend, whom they can drop a piece of malware into their machine, with an email similar to the one you have recieved and scrape all the addresses that they have received an email from, or written an email to. No email address is completely hidden from these people. BM

By: Greg

Greg — Tue, 29 Nov 2011 17:39:08 +0000

November 28, 2011
Owner/Manager
RE: Case # 55673368 Samuel O\’Neal

The Better Business Bureau has received the above-referenced complaint from one of your customers regarding their dealings with you. The details of the consumer\’s concern are included on the reverse. Please review this matter and advise us of your position.

As a neutral third party, the Better Business Bureau can help to resolve the matter. Often complaints are a result of misunderstandings a company wants to know about and correct.

In the interest of time and good customer relations, please provide the BBB with written verification of your position in this matter by December 02, 2011 . Your prompt response will allow BBB to be of service to you and your customer in reaching a mutually agreeable resolution. Please inform us if you have contacted your customer directly and already resolved this matter.

The Better Business Bureau develops and maintains Reliability Reports on companies across the United States and Canada . This information is available to the public and is frequently used by potential customers. Your cooperation in responding to this complaint becomes a permanent part of your file with the Better Business Bureau. Failure to promptly give attention to this matter may be reflected in the report we give to consumers about your company.

We encourage you to use our ONLINE COMPLAINT system to respond this complaint. The following URL (website address) below will take you directly to this complaint and you will be able to enter your response directly on our website: This would appear to be another phishing scam email, but nothing to do with the subject of the article. BM

By: pamvdn

pamvdn — Mon, 28 Nov 2011 17:48:32 +0000

For now I received the same mail as you have (4 times), this after I tryed to pay something.
I called my bank and there were no suspicious things going on on my account.
The mails I did forward to them.

By: Stacy

Stacy — Fri, 25 Nov 2011 21:07:51 +0000

Oh - and I called my credit union, who said no suspicious activity has been noted on my account.

I also called the number to the supposed “NACHA” in the email, and it goes to a Verizon phone number, with an automated message that says “The number you dialed has been changed, disconnected, or is no longer in service. If you feel you have reached this recording in error, please check the number and try your call again….”

I then called the number on the NACHA website, 703-561-1100, and listened to a message from them saying the email is fraudulent, and that the attachment is a virus.

By: Stacy

Stacy — Fri, 25 Nov 2011 21:00:30 +0000

This is the second time I received one of these:

——-Original Message——-
From: The Electronic Payments Association
To:
Subject: ACH transfer rejected
Sent: 25 Nov ‘11 05:20

The ACH transfer (ID: 464373483745) recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Please download the attachment (transfer report pdf).
Download report 25.11.pdf.zip

If you have any questions please contact us at info @nacha.org.
Thank you for using nacha.org.

Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA

3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489

By: Terrie Jo

Terrie Jo — Fri, 25 Nov 2011 20:25:26 +0000

I got the exact same e-mail from “Patrick Wilson”. I didn’t open or download anything. I used copy/paste to put the phone number in my web browser which brought me to this web site. I deleted the message right away. Thanks for providing this information. You are most welcome, Terrie Jo, have a mighty fine day, BM

By: bob

bob — Fri, 25 Nov 2011 13:08:14 +0000

I get these all the time, often several each day. It does not cause problems as I know it is just a scam and are immediately deleted. Is there no way anybody can locate the source of these emails? Would be nice if the person responsible can be found so someone can put a .22 in the back of their skull! Really? Shoot someone in the head for sending an unwanted email?

By: JP

JP — Wed, 23 Nov 2011 16:14:56 +0000

I got this email from them today…

————–

Attn: Financial Department

We regret to inform you, that your most recent Direct Deposit via ACH payment (Int. No.994293980183) was rejected, because your business software package was out of date. The detailed information about this matter is available in the secure section of our web site:

varshiniproperties.com/3f034d/index.html

Please apply to your financial institution to obtain the necessary updates of the Direct Deposit software.

Best regards,

ACH Network Rules Department
NACHA | The Electronic Payments Association

13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
Phone: 703-561-1100 Fax: 703-787-0996

By: Arty

Arty — Tue, 22 Nov 2011 18:38:35 +0000

I received this email from Samuel Anderson

I found this weird because it was on my UK University email which I don’t share with any website so I haven’t a clue how I got it!!

By: Lilian Driessen

Lilian Driessen — Wed, 16 Nov 2011 19:10:47 +0000

I’ve received the same mail from Robert Dobs, I live in the Netherlands and don’t pay bills in the states.
The letter was also signed Patrick Wilson ( does excist he’s an actor)

By: steve allen

steve allen — Wed, 16 Nov 2011 14:04:27 +0000

got an email from Northern Rock building society (UK) requesting info, apparently it has come from ” Samuel.anderson@ Nacha.org !
Phishing !

By: Whitney Dix

Whitney Dix — Wed, 16 Nov 2011 03:33:13 +0000

I have the same email…..but I opened it because it came to my school account and I live in the states…… It came from samuel.anderson@Nacha.org but says Patrick Wilson in the email

The ACH transfer (ID: 59284589092341), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Patrick Wilson
blah, blah………

By: SEO New York

SEO New York — Wed, 16 Nov 2011 00:28:54 +0000

For some reason I get a lot from this company which I delete immediately Sometimes I get several in one day. Here is a copy of one I just received:

The ACH transfer (ID: 59284589063432), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

By: L

Tue, 15 Nov 2011 18:39:58 +0000

I got the same one!!

By: Patrick

Patrick — Tue, 15 Nov 2011 17:22:28 +0000

I got it too this morning. 11/15/11

The ACH transfer (ID: 59284589007270), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Patrick Wilson
blah blah…………

By: steve

steve — Tue, 15 Nov 2011 17:04:59 +0000

My was exactly the same, but different ID:######. Since the ID numbers are different, maybe this is legit! JK Thanks for the posting Really? Do you really think that?

By: Darrell

Darrell — Tue, 15 Nov 2011 16:40:01 +0000

The ACH transfer (ID: 59284589098167), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Patrick Wilson blah blah…

By: Pjiotr (Netherlands)

Pjiotr (Netherlands) — Tue, 15 Nov 2011 16:30:39 +0000

I got this at 4.53 PM local time today:

The ACH transfer (ID: 59284589003636), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Please download the attachment(transfer report pdf).

Patrick Wilson blah blah.

By: Robert

Robert — Tue, 15 Nov 2011 16:26:13 +0000

I am so sick of getting these! I get 3 -4 of them a day and its effecting my business. I do regular bank transfers and it freaks me out every time this pops up. Does anyone have any suggestions on how to stop them! I’m interested in how 4 spam emails coming in is effecting your business, Robert. Just delete them and move on with your day. Don’t worry, life is far too short. BM

By: jule

jule — Tue, 15 Nov 2011 14:58:20 +0000

I received the same email as well as traffice tickets in NY, i AM IN TORONTO. Anyways, I figured it out right away.
Suckers.

By: Joe Blowjo

Joe Blowjo — Tue, 15 Nov 2011 14:21:50 +0000

From: Robert Dobs
Subject: Bill payment canceled
Date: August 3, 2011 2:45:01 AM ADT

The ACH transfer (ID: 59284589052161), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

blah, blah…………

No need to be scared of leaving your name Mr Blojo, nobody reading this knows who you are) There are a lot of Michaels around…. BM

By: Beth

Beth — Tue, 15 Nov 2011 13:08:23 +0000

I received this email today from Robert Dobs. Thank you for posting this - has anyone called the 703 phone number to let them know?

By: Chris

Chris — Mon, 14 Nov 2011 21:02:09 +0000

I received the same email this morning from Nicole Jackson (nicole.jackson@nacha.org); body of the email is found below.

The ACH transfer (ID: 59284589047210), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Please download the attachment(transfer report pdf).

If you have any questions please contact us at info@ nacha.org.
Thank you for using nacha.org.

Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA

3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489

By: Bob

Bob — Mon, 14 Nov 2011 18:06:16 +0000

For some reason I get a lot from this company which I delete immediately Sometimes I get several in one day. Here is a copy of one I just received:

The ACH transfer (ID: 59284589063432), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Rest of details, as above.

By: M D

M D — Mon, 14 Nov 2011 17:30:05 +0000

I received an email identical to the above except it came from nicole jackson at nacha.org and the ID was number was different - 59284589003230.

I live in California and received this today although the date sent was August 2, 2011 11:16:39 PM PDT

By: Mike

Mike — Mon, 14 Nov 2011 16:06:18 +0000

Same email also from Nicole Jackson

By: Art Spery

Art Spery — Mon, 14 Nov 2011 15:38:29 +0000

Got the same email…different “sender” and “ID”

DATE:
11/14/11 10:09 AM [ Full Screen ] [ SIZE: 34.939KB ]
Add To Address Book Add To White List FROM: Nicole Jackson
Add To Address Book Add To White ListTO:
SUBJECT: SPAM[3] -> Bill payment canceled
ATTACH: report_837749598.pdf.zip

The ACH transfer (ID: 59284589023472), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Please download the attachment(transfer report pdf).

If you have any questions please contact us at info@ nacha.org.
Thank you for using nacha.org.

Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA

3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489

I notice it is from Nicole Jackson, but signed Patrick Wilson - quality spam, eh? BM

By: paul

paul — Mon, 14 Nov 2011 15:09:57 +0000

The ACH transfer (ID: 59284589005458), recently initiated from your bank
account, was canceled by The Electronic Payments Association (NACHA).

Blah, blah, blah………………..

Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA

3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489

The attachment is a .zip file disguised as a .pdf file format, probably a .exe auto run program. (bad) glad I’m not on a PC.

By: K

Mon, 14 Nov 2011 13:48:03 +0000

i got this today:

From: “Robert Dobs”
Date: August 3, 2011 2:13:30 AM EDT
To:
Subject: Bill payment canceled

The ACH transfer (ID: 59284589096507), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).

Please download the attachment(transfer report pdf).

If you have any questions please contact us at info@ nacha.org.
Thank you for using nacha.org.

Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA

3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489

By: Jan Nijmeijer

Jan Nijmeijer — Mon, 14 Nov 2011 13:09:43 +0000

I’ve got exactly the same email, also I got email about traffic tickets in the US while I live in Europe and visited the US in 2004 for the last time