Bill payment canceled phishing spam email
I received a spam email this morning, with the subject, Bill payment canceled. UK readers probably spotted it as spam right away, as the Americans spell cancelled, “canceled”, but just in-case anyone is checking if they have had a bill payment cancelled, here are the details:
Email subject: Bill payment canceled
From Ronald Crown [ronald.crown@nacha.org]
Attachment: report 837749598.pdf.zip (24 KB)
The ACH transfer (ID: 59284589009450), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).
Please download the attachment(transfer report pdf).
If you have any questions please contact us at info@nacha.org.
Thank you for using http://www.nacha.org/.
Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA
3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489
If you receive the same or similar phishing Bill payment canceled email from Ronald Crown, or anyone else, first of all delete it without opening anything and then, if you have two minutes, send us a comment if there are any different details in your email. Thanks.
49 Responses to “Bill payment canceled phishing spam email”
November 14th, 2011 at 1:09 pm
I’ve got exactly the same email, also I got email about traffic tickets in the US while I live in Europe and visited the US in 2004 for the last time
November 14th, 2011 at 3:09 pm
The ACH transfer (ID: 59284589005458), recently initiated from your bank
account, was canceled by The Electronic Payments Association (NACHA).
Blah, blah, blah………………..
Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA
3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489
The attachment is a .zip file disguised as a .pdf file format, probably a .exe auto run program. (bad) glad I’m not on a PC.
November 14th, 2011 at 3:38 pm
Got the same email…different “sender” and “ID”
DATE:
11/14/11 10:09 AM [ Full Screen ] [ SIZE: 34.939KB ]
Add To Address Book Add To White List FROM: Nicole Jackson
Add To Address Book Add To White ListTO:
SUBJECT: SPAM[3] -> Bill payment canceled
ATTACH: report_837749598.pdf.zip
The ACH transfer (ID: 59284589023472), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).
Please download the attachment(transfer report pdf).
If you have any questions please contact us at info@ nacha.org.
Thank you for using nacha.org.
Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA
3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489
I notice it is from Nicole Jackson, but signed Patrick Wilson - quality spam, eh? BM
November 14th, 2011 at 5:30 pm
I received an email identical to the above except it came from nicole jackson at nacha.org and the ID was number was different - 59284589003230.
I live in California and received this today although the date sent was August 2, 2011 11:16:39 PM PDT
November 14th, 2011 at 6:06 pm
For some reason I get a lot from this company which I delete immediately Sometimes I get several in one day. Here is a copy of one I just received:
The ACH transfer (ID: 59284589063432), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).
Rest of details, as above.
November 14th, 2011 at 9:02 pm
I received the same email this morning from Nicole Jackson (nicole.jackson@nacha.org); body of the email is found below.
The ACH transfer (ID: 59284589047210), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).
Please download the attachment(transfer report pdf).
If you have any questions please contact us at info@ nacha.org.
Thank you for using nacha.org.
Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA
3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489
November 15th, 2011 at 1:08 pm
I received this email today from Robert Dobs. Thank you for posting this - has anyone called the 703 phone number to let them know?
November 15th, 2011 at 2:21 pm
From: Robert Dobs
Subject: Bill payment canceled
Date: August 3, 2011 2:45:01 AM ADT
The ACH transfer (ID: 59284589052161), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).
blah, blah…………
No need to be scared of leaving your name Mr Blojo, nobody reading this knows who you are) There are a lot of Michaels around…. BM
November 15th, 2011 at 2:58 pm
I received the same email as well as traffice tickets in NY, i AM IN TORONTO. Anyways, I figured it out right away.
Suckers.
November 15th, 2011 at 4:26 pm
I am so sick of getting these! I get 3 -4 of them a day and its effecting my business. I do regular bank transfers and it freaks me out every time this pops up. Does anyone have any suggestions on how to stop them! I’m interested in how 4 spam emails coming in is effecting your business, Robert. Just delete them and move on with your day. Don’t worry, life is far too short. BM
November 15th, 2011 at 4:30 pm
I got this at 4.53 PM local time today:
The ACH transfer (ID: 59284589003636), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).
Please download the attachment(transfer report pdf).
Patrick Wilson blah blah.
November 15th, 2011 at 4:40 pm
The ACH transfer (ID: 59284589098167), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).
Patrick Wilson blah blah…
November 15th, 2011 at 5:04 pm
My was exactly the same, but different ID:######. Since the ID numbers are different, maybe this is legit! JK Thanks for the posting Really? Do you really think that?
November 15th, 2011 at 5:22 pm
I got it too this morning. 11/15/11
The ACH transfer (ID: 59284589007270), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).
Patrick Wilson
blah blah…………
November 16th, 2011 at 12:28 am
For some reason I get a lot from this company which I delete immediately Sometimes I get several in one day. Here is a copy of one I just received:
The ACH transfer (ID: 59284589063432), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).
November 16th, 2011 at 3:33 am
I have the same email…..but I opened it because it came to my school account and I live in the states…… It came from samuel.anderson@Nacha.org but says Patrick Wilson in the email
The ACH transfer (ID: 59284589092341), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).
Patrick Wilson
blah, blah………
November 16th, 2011 at 2:04 pm
got an email from Northern Rock building society (UK) requesting info, apparently it has come from ” Samuel.anderson@ Nacha.org !
Phishing !
November 16th, 2011 at 7:10 pm
I’ve received the same mail from Robert Dobs, I live in the Netherlands and don’t pay bills in the states.
The letter was also signed Patrick Wilson ( does excist he’s an actor)
November 22nd, 2011 at 6:38 pm
I received this email from Samuel Anderson
I found this weird because it was on my UK University email which I don’t share with any website so I haven’t a clue how I got it!!
November 23rd, 2011 at 4:14 pm
I got this email from them today…
————–
Attn: Financial Department
We regret to inform you, that your most recent Direct Deposit via ACH payment (Int. No.994293980183) was rejected, because your business software package was out of date. The detailed information about this matter is available in the secure section of our web site:
varshiniproperties.com/3f034d/index.html
Please apply to your financial institution to obtain the necessary updates of the Direct Deposit software.
Best regards,
ACH Network Rules Department
NACHA | The Electronic Payments Association
13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
Phone: 703-561-1100 Fax: 703-787-0996
November 25th, 2011 at 1:08 pm
I get these all the time, often several each day. It does not cause problems as I know it is just a scam and are immediately deleted. Is there no way anybody can locate the source of these emails? Would be nice if the person responsible can be found so someone can put a .22 in the back of their skull! Really? Shoot someone in the head for sending an unwanted email?
November 25th, 2011 at 8:25 pm
I got the exact same e-mail from “Patrick Wilson”. I didn’t open or download anything. I used copy/paste to put the phone number in my web browser which brought me to this web site. I deleted the message right away. Thanks for providing this information. You are most welcome, Terrie Jo, have a mighty fine day, BM
November 25th, 2011 at 9:00 pm
This is the second time I received one of these:
——-Original Message——-
From: The Electronic Payments Association
To:
Subject: ACH transfer rejected
Sent: 25 Nov ‘11 05:20
The ACH transfer (ID: 464373483745) recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).
Please download the attachment (transfer report pdf).
Download report 25.11.pdf.zip
If you have any questions please contact us at info @nacha.org.
Thank you for using nacha.org.
Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA
3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489
November 25th, 2011 at 9:07 pm
Oh - and I called my credit union, who said no suspicious activity has been noted on my account.
I also called the number to the supposed “NACHA” in the email, and it goes to a Verizon phone number, with an automated message that says “The number you dialed has been changed, disconnected, or is no longer in service. If you feel you have reached this recording in error, please check the number and try your call again….”
I then called the number on the NACHA website, 703-561-1100, and listened to a message from them saying the email is fraudulent, and that the attachment is a virus.
November 28th, 2011 at 5:48 pm
For now I received the same mail as you have (4 times), this after I tryed to pay something.
I called my bank and there were no suspicious things going on on my account.
The mails I did forward to them.
November 29th, 2011 at 5:39 pm
November 28, 2011
Owner/Manager
RE: Case # 55673368 Samuel O\’Neal
The Better Business Bureau has received the above-referenced complaint from one of your customers regarding their dealings with you. The details of the consumer\’s concern are included on the reverse. Please review this matter and advise us of your position.
As a neutral third party, the Better Business Bureau can help to resolve the matter. Often complaints are a result of misunderstandings a company wants to know about and correct.
In the interest of time and good customer relations, please provide the BBB with written verification of your position in this matter by December 02, 2011 . Your prompt response will allow BBB to be of service to you and your customer in reaching a mutually agreeable resolution. Please inform us if you have contacted your customer directly and already resolved this matter.
The Better Business Bureau develops and maintains Reliability Reports on companies across the United States and Canada . This information is available to the public and is frequently used by potential customers. Your cooperation in responding to this complaint becomes a permanent part of your file with the Better Business Bureau. Failure to promptly give attention to this matter may be reflected in the report we give to consumers about your company.
We encourage you to use our ONLINE COMPLAINT system to respond this complaint. The following URL (website address) below will take you directly to this complaint and you will be able to enter your response directly on our website: This would appear to be another phishing scam email, but nothing to do with the subject of the article. BM
December 12th, 2011 at 5:50 pm
“From: Harold Zamora
This notice concerns the ACH transfer (ID: 81088426524) that
was recently sent from your account.
The current status of the referred transfer is: failed due to
the system malfunctioning. Please check the report below to learn
more:
[link, allegedly to bisonbuy.com]
Yours faithfully,
Harold Zamora
2011 NACHA - The Electronic Payments Association
13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171″
No attachment - I’m assuming a fraudulent link with virus on site.
I’m oddly amused by the email address used to send the spam. How very legit looking.
What does concern me is that they reached my private email rather than the one I use for online transactions. Unfortunatley, you only have to use your email once, for these scammers to find it. Either online, or sending to a friend, whom they can drop a piece of malware into their machine, with an email similar to the one you have recieved and scrape all the addresses that they have received an email from, or written an email to. No email address is completely hidden from these people. BM
December 15th, 2011 at 7:44 pm
I recieved the following email,
From: The Electronic Payments Association [mailto:info@ nacha.org]
Sent: Thursday, December 15, 2011 4:49 AM
To: xxhunter@ q.com
Subject: [Norton AntiSpam]ACH transaction suspended
The ACH transaction (ID: 82064125681392), recently sent from your bank account (by you or any other person), was canceled by the Electronic Payments Association.
Rejected transaction
Transaction ID: 82064125681392
Rejection Reason See details in the report below
Transaction Report report_82064125681392.doc (Microsoft Word Document)
13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100
© 2011 NACHA - The Electronic Payments Association
Don’t really understand how it wound up in my “inbox” (originally tagged as SPAM by Norton’s spam filter for MS Outlook) as the email address it says it was sent to, “xxhunter@Q” while close to the address I often use, isn’t my email address. I’ve been reluctant to opent the transaction report link - so I don’t know what that document says. Googled for, and search the NACHA site to see if there was any provision for reporting or asking about phishing using their bona fides, but did not see anything to do so.
December 15th, 2011 at 7:50 pm
Took me a moment to find it, but FWIW anyone recieveing these phishing NACHA spam emails might want to forward a copy to abuse@ nacha.org.
December 17th, 2011 at 2:43 am
To xxx@ hotmail.com
From: Richardcallan (acooper@ ehousemedia.com)
Same message as described above. I also will send this to the Commonwealth of VA Attorney General as it is in their state.
December 17th, 2011 at 2:49 pm
Details showed the email was sent to a lot of variant spellings of my name.
The ACH transaction (ID: 740100262620), recently sent from your checking account (by you or any other person), was canceled by the Electronic Payments Association.
Canceled transfer
Transaction ID: 740100262620
Reason for rejection See details in the report below
Transaction Report report_740100262620.do c (Microsoft Word Document)
13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100
© 2011 NACHA - The Electronic Payments Association
January 27th, 2012 at 12:17 pm
Similar one (but less detail and no attachment - maybe stripped off by my email provider).
The ACH transaction (ID: 8438244421005), recently sent from your bank account (by you or any other person), was canceled by the Electronic Payments Association.
Rejected transfer
Transaction ID: 8438244421005
Reason of rejection See details in the report below
Transaction Report report_8438244421005.doc (Microsoft Word Document)
13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
2011 NACHA - The Electronic Payments Association
January 27th, 2012 at 1:33 pm
I got roughly the same thing, but the funny thing is the link leads to a part of quemonono.com, which is a bizarre, yet innocent-looking site =D Clicking on the link may have downloaded malware into your machine. I can’t say for certain, but it’s worth running a virus scan just in case BM
January 27th, 2012 at 4:37 pm
I got this email today, Contents were:
The ACH transaction (ID: 839370646156), recently initiated from your checking account (by you or any other person), was rejected by the Electronic Payments Association.
Canceled transfer
Transaction ID: 839370646156
Reason for rejection See details in the report below
Transaction Report report_839370646156.doc (Microsoft Word Document)
13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
2011 NACHA - The Electronic Payments Association
January 30th, 2012 at 5:51 pm
The version I got today was this:
The ACH transaction (ID: 7594411361655), recently sent from your checking account (by you or any other person), was rejected by the Electronic Payments Association.
Rejected transfer
Transaction ID: 7594411361655
Reason for rejection See details in the report below
Transaction Report report_7594411361655.doc (Microsoft Word Document)
13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
2011 NACHA - The Electronic Payments Association
The link for the “transaction report” is:
mancinelliefalconi.gov.it/983oXPvx/index.html
February 29th, 2012 at 4:42 pm
I received an email from The Electronic Payments Assocation when I clicked on the name it is terryjackson256@ bellsouth.net.
It states ACH Transfer erro
Dear Customer,
Regretfully we have to inform you, that Direct Deposit (#ACH345330434281US) has not been credited, becuse of discontined receipient account.
they are asking for correct banking information
2012 NACHA out of 13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171 (703) 561-1100
Who are these people?? How can these people take our hard earned money?? There are so many scams out there who do you know who you can trust? That’s why I post these articles. Thanks for contributing. BM
July 5th, 2012 at 2:01 pm
My link led to this website, originating in China:
characterfirst.com.cn/acinfo.html
needless to say I didn’t follow it!
July 5th, 2012 at 2:22 pm
I received this phishing email in the UK today:
The ACH transaction (ID: 131814796716), recently sent from your checking account (by you or any other person), was canceled by the Electronic Payments Association.
Canceled transaction
Transaction ID: 131814796716
Rejection Reason See details in the report below
Transaction Report report_131814796716.doc (Microsoft Word Document)
13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
2011 NACHA - The Electronic Payments Association
November 8th, 2012 at 1:41 pm
This is the e-mail that I got today, I did report it to our IT people as it came to my work e-mail.
The ACH transfer (ID: 44C31E9E4B96), recently initiated from your checking account (by you or any other person), was rejected by the other financial institution.
Transaction ID: 44C31E9E4B96
Reason for rejection See details in the report below
Transaction Report 44C31E9E4B96.doc (Microsoft Word Document)
13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100
© 2011 NACHA - The Electronic Payments Association
November 8th, 2012 at 4:21 pm
Had the same today 8th November just different numbers.
This is so blatant - is there no way to slap these SOB’s back ?
Preferable in their pocket. Also, as there have been so many, why cannot the ISP’s accept some responsibility and they sure as hell have enough financial resources to name. shame and hit them hard. Unfortunately, there is nothing you can do about it. Just delete the email, block the address and move on with your day
November 9th, 2012 at 4:13 pm
Get this mail today in germany.
[Norton AntiSpam]ACH transaction (ID: 4AD190CAD1C) was rejected
Rejected transfer
The ACH transaction (ID: 4AD190CAD1C), recently initiated from your bank account (by you or any other person), was canceled by the other financial institution.
Transaction ID: 4AD190CAD1C
Reason of rejection See details in the report below
Transaction Report ACH_Report-4AD190CAD1C.pdf (Adobe Reader PDF)
13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100
© 2011 NACHA - The Electronic Payments Association
ACH_Report-4AD190CAD1C.pdf.zip(179 B)
November 10th, 2012 at 12:58 am
I got 2 of these e-mails from NACHA I looked up the IP adress, It’s somewhere close to Warsaw Poland.
November 10th, 2012 at 6:07 am
Here is what I received today Nov 10, 2012
NACHA
Rejected transfer
The ACH transfer (ID: CA38F346F3), recently sent from your checking account (by you or any other person), was canceled by the Electronic Payments Association.
Transaction ID: CA38F346F3
Reason of rejection See details in the report below
Transaction Report ACH_Report-CA38F346F3.doc (Microsoft Word Document)
13450 Sunrise Valley Drive, Suite 100 Herndon, VA 20171 (703) 561-1100
© 2011 NACHA - The Electronic Payments Association
1 Attached file| 63KB
ACH_Report-CA38F346F3.doc.zip
Download
November 13th, 2012 at 9:57 pm
I have received 3 emails like this
We are sorry to inform you, that your most recent Direct Deposit transaction (IN837594118319) was disallowed, because your current Direct Deposit software version was out of date. The detailed information about this matter is available in the secure section of our web site:
Details
Please consult with your financial institution to get the updated version of the software.
Yours truly,
ACH Network Rules Department
NACHA | The Electronic Payments Association
12388 Sunrise Valley Drive, Suite 199
Herndon, VA 20387
Phone: 703-145-9612 Fax: 703-519-6507
November 27th, 2012 at 3:01 pm
And here is another one:
Herewith we are informing you, that your latest Direct Deposit transaction (ID496210841884) was cancelled, due to your business software package being out of date. The details regarding this matter are available in our secure section::
Details
Please apply to your financial institution to get your updated version of the software needed.
Yours truly,
ACH Network Rules Department
NACHA | The Electronic Payments Association
16845 Sunrise Valley Drive, Suite 387
Herndon, VA 22274
Phone: 703-324-2551 Fax: 703-980-9052
December 11th, 2012 at 10:59 pm
My company emails across the board are now getting these daily!
Does anyone know how to get rid of them completely, we all immeadiately move them to junk and block sender, however the next day its the same stuff coming from new email addresses?
We are sorry to notify you, that your latest Direct Deposit via ACH payment (No.526446639819) was disallowed, because of your current Direct Deposit software being out of date. Please use the link below to enter the secure section of our web site and see the details::
Details
Please consult with your financial institution to obtain the new version of the software.
Sincerely yours
ACH Network Rules Department
NACHA | The Electronic Payments Association
10528 Sunrise Valley Drive, Suite 987
Herndon, VA 27366
Phone: 703-707-1868 Fax: 703-773-2429
November 14th, 2011 at 1:48 pm
i got this today:
From: “Robert Dobs”
Date: August 3, 2011 2:13:30 AM EDT
To:
Subject: Bill payment canceled
The ACH transfer (ID: 59284589096507), recently initiated from your bank account, was canceled by The Electronic Payments Association (NACHA).
Please download the attachment(transfer report pdf).
If you have any questions please contact us at info@ nacha.org.
Thank you for using nacha.org.
Patrick Wilson
Department of Risk Management,
Insurance & Loss Prevention.
NACHA
3450 Sunrise Valley dr.
Suite 125
Herndon, VA 20170
(703)232-7624 ext 489