a compass with the words chance, success, risk and failure on the face
Robert L. Weiner: Nonprofit Fundraising Technology Consulting
  • Home
  • Clients
  • Resources
    • CRMs and Donor Databases – Vendors
    • CRMs and Donor Databases – Selection and Strategy
    • CRMs and Donor Databases – Implementation
    • CRMs and Donor Databases – Management
    • Development Operations/Development Services/Advancement Services
    • Email Marketing
    • Newsletters
    • Online Fundraising
    • Online Privacy
    • Social Media
    • Spam
    • Technology Planning
    • Hiring Consultants
    • For Consultants
    • Other Resources
  • Robert Weiner’s Blog
    • Get My Blog Via Email
    • Blogroll
  • About
    • Testimonials
    • Articles by Robert Weiner
    • Presentations by Robert Weiner
    • Robert’s Tweets
    • Services
      • Needs Assessments
      • Vendor Selection
      • Process Improvement
      • Staffing
      • Technology Planning
      • Implementation Support
      • On-Call Advice
  • Contact

Lame spam of the day: America Airlines ticket order

November 3, 2011 By Robert 127 Comments Filed Under: Scam, Spam Tagged With: Scam, Spam

This one caught my eye for a second. I thought, “I don’t remember booking anything with American lately.”  The lazy spammer didn’t even bother to include any graphics to make it look official. 

Sender: American Airlines (information-no77537@aa.com)

Subject: Your Order##91991988

Text:
Dear Customer,

FLIGHT NUMBER 984
ELECTRONIC 746879098
DATE & TIME / NOVEMBER 17, 2011, 11:53 PM
ARRIVING / NEW YORK JFK
TOTAL PRICE / 321.56 USD

Please find your ticket attached.
You can print your ticket.

Thank you for using our airline company services.
American Airlines.

Attachment: AA_Ticket_#8565.zip

==================

Update:

I received the following variant on Nov. 28.  No attachment this time, just a link.  And this one didn’t say which airline it came from (other than the signature, “Airlines America”).  The price of my mythical flight has gone up, though.

Sender: support@rlweiner.com (gee, that’s me!)

Subject: Fwd: Re: Your Flight Order N2295-505368

Dear Customer,

FLIGHT ELECTRONIC NUMBER 590191204
DATE & TIME / DECEMBER 26, 2011, 16:13 PM
ARRIVING AIRPORT: NEW YORK JFK
PRICE : 411.35 USD

Please download and print out your ticket here:
http://www.airlines.com/flight-06250762055

BRITTNI BEAL,
Airlines America

Fingerprint: f8a09213-4b65e7cd
 

Robert

Comments

  1. Sophie says

    March 1, 2012 at 8:28 am

    I got one of these today and I did panic a little at first… I’m always so paranoid about my details and of course straight away I assume someone had been using my credit card and all my details. So glad it’s spam though. So thanks! (:

  2. Lisa says

    March 12, 2012 at 2:23 pm

    I also got one on the 9th march, but have only just noticed it as it was sent to my junk emails, I still panicked at first thinking someone had got my card details, thanks to this site it was deleted!

  3. Trish says

    March 16, 2012 at 2:08 pm

    This is the one I got today… Where the heck is Plano?

    Hello

    FLIGHT NUMBER AS2487
    ELECTRONIC 1508967
    DATE & TIME / MARCH 24, 2012, 10:29 PM
    ARRIVING / Plano
    TOTAL PRICE / 214.14USD

    Your ticket is attached.
    You can print your ticket.

    Thank you
    American Airlines.

  4. Trish says

    March 16, 2012 at 2:10 pm

    (news-no49101@aa.com) This is the email mine origionated from.

  5. Robert says

    March 16, 2012 at 2:13 pm

    Plano is in Texas. American doesn’t even fly there. In fact, it looks like there isn’t even an airport there.

  6. Craig says

    March 29, 2012 at 2:42 am

    Got the same thing with a .zip file attached. I found it amusing that the flight was supposedly booked for 02/12/2012 yet I didn’t get the email until 02/28/2012. 16 days after my flight apparently already left LOL!!!

    Dear Customer,

    FLIGHT NUMBER AA643
    ELECTRONIC 3599655
    DATE & TIME / FEBRUARY 18, 2012, 09:25 AM
    ARRIVING / St.Paul
    TOTAL PRICE / 351.21 USD

    Please find your ticket attached.
    You can print your ticket.

    Thank you for your attention.
    AA customer services.

  7. Bhryn says

    June 21, 2012 at 2:26 pm

    OH I guess this is still going on. So Fremont is in CA and I need a parachute huh? Damn. I mean, a ticket for 320 bucks from the UK to the US isn’t so bad… Haha. Probably one of the worse scams I’ve seen. I’ve flown AA before (as I fly via them and their carriers to see my partner who is stationed in San Angelo down in Texas) so I knew it was fake to begin with, but now knowing I need to parachute just adds a level of giggles to this…

  8. Robert says

    June 21, 2012 at 3:33 pm

    Maybe they’d let you out in Oakland — there’s an airport there. 😉

  9. Susan D says

    October 3, 2012 at 1:50 pm

    hahaha – – Received this today (Oct. 3, 2012) – – Rancho Cucamonga?? – – Really??

    Dear Customer,

    TICKET / 1 701 5817501764 1
    SEAT / 29E/ZONE 2
    DATE / TIME 20 OCTOBER, 2012, 10:29 AM
    ARRIVING / Rancho Cucamonga
    FORM OF PAYMENT / CC
    TOTAL PRICE / 154.54 USD
    REF / EF4645 ST / OK
    BAG / 7PC

    Your bought ticket is attached to the letter as a scan document.
    To use your ticket you should print it.

    Thank you
    American Airlines.

  10. Robert says

    October 3, 2012 at 5:07 pm

    Yes Susan, there is a Rancho Cucamonga. But I don’t think they have an airport. Maybe just a municipal one.

  11. zach says

    October 5, 2012 at 11:55 am

    just got this one. at first i was like, I thought my wife booked with Delta, then noticed the destination was Seattle, wait she’s going to Chicago. this spam is definitely lame.

    Dear Customer,

    E-TICKET NUMBER / 1 983 1199935918 1
    SEAT / 37A/ZONE 3
    DATE / TIME 26 OCTOBER, 2012, 10:09 AM
    ARRIVING / Seattle
    FORM OF PAYMENT / CC
    TOTAL PRICE / 176.76 USD
    REF / OE9125 ST / OK
    BAG / 4PC

    Your ticket is attached.
    To use your ticket you should print it.

    Thank you for your attention.
    American Airlines.

  12. Robert says

    October 5, 2012 at 1:57 pm

    I’ve been getting fake Delta messages as well. The subjects have been:

    Your order is processed
    Your order #184052 has been completed
    Order #9720 is processed

    No graphics, no logos, just plain, lame text, like this:

    Hello,

    E-TICKET / EH183155337
    SEAT / 65E/ZONE 2
    DATE / TIME 4 OCTOBER, 2012, 11:35 AM
    ARRIVING / San Francisco
    FORM OF PAYMENT / CC
    TOTAL PRICE / 237.36 USD
    REF / OE.7601 ST / OK
    BAG / 3PC

    Please find your ticket attached.
    You can print your ticket.

    Thank you for your attention.
    Delta Air Lines.

    That one was amusing, since I was already in San Francisco on the 4th. Another version sent me to Wichita, a third to Arlington. Each one has an attachment called Delta_A_Ticket_Print_Document_nnnn.zip (the numbers have differed).

  13. BobF says

    October 6, 2012 at 1:03 pm

    I just got this today. I knew it was spam. What pisses me off though, is that AVG and MalwareBytes did not alert on the scan of the AA_Ticket_Print_Document.exe that was attached. Of course I did not run it, but was extremely disappointed in my security packages.

  14. Daffodil says

    October 7, 2012 at 10:20 pm

    I got one today too.

    On Tue, Oct 2, 2012 at 8:10 PM, American Airlines wrote:
    Dear Customer,

    E-TICKET NUMBER / 1 676 1005881675 1
    SEAT / 39A/ZONE 2
    DATE / TIME 19 OCTOBER, 2012, 12:21 AM
    ARRIVING / Anchorage
    FORM OF PAYMENT / CC
    TOTAL PRICE / 141.41 USD
    REF / KE2981 ST / OK
    BAG / 7PC

    Your bought ticket is attached.
    You can print your ticket.

    Thank you
    American Airlines.

  15. Regina says

    November 8, 2012 at 11:02 am

    Well now Delta is sending them 😉

    Dear Customer,

    TICKET NUMBER / EH145100661
    SEAT / 74F/ZONE 2
    DATE / TIME 26 NOVEMBER, 2012, 12:35 AM
    ARRIVING / Stockton
    FORM OF PAYMENT / XXXXXX
    TOTAL PRICE / 225.92 USD
    REF / LE.8261 ST / OK
    BAG / 5PC

    Your bought ticket is attached.
    You can print your ticket.

    To open archive, pleace use password: deltaairlines

    Thank you for your attention.
    Delta Air Lines.

    .rar file attached

  16. RM says

    November 8, 2012 at 9:27 pm

    received one today 11/8/2012

    Subject: Your order is ready
    From: American Airlines
    Sent: Nov 8, 2012 06:29:21 PM
    To:
    Reply-To: your_ticket@a-airlines.com
    Attachments : TICKET-FLY986404AA.rar

    To open archive pleace use this password: AATicket Dear Customer,

    E-TICKET / 3 504 1291968873 3
    SEAT / 72A/ZONE 3
    DATE / TIME 27 JUNE, 2012, 10:46 AM
    ARRIVING / Kansas City
    FORM OF PAYMENT / CC
    TOTAL PRICE / 366.66 USD
    REF / KE8903 ST / OK
    BAG / 7PC

    Your ticket is attached.
    You can print your ticket.

    To open archive please use this password: ticket24

    Thank you for your attention.
    American Airlines.

    So no zip file for me, just a rar file which I didn’t open.

    Mine was really sloppy – check out the date of the flight, “27 June 2012” – that’s over four months ago!

  17. MWH says

    November 13, 2012 at 6:23 pm

    Received one last week with a .rar file attachment that I did not open:

    To open archive pleace use this password: AATicket Dear Customer,

    TICKET NUMBER / 2 619 1306159979 2
    SEAT / 57A/ZONE 3
    DATE / TIME 19 JUNE, 2012, 10:56 AM
    ARRIVING / Moreno Valley
    FORM OF PAYMENT / CC
    TOTAL PRICE / 225.25 USD
    REF / OE7473 ST / OK
    BAG / 6PC

    Your bought ticket is attached to the letter as a scan document.
    You can print your ticket.

    To open archive please use this password: ticket82

    Thank you
    American Airlines.

  18. Robert says

    November 13, 2012 at 6:33 pm

    You were smart not to open the attachment.

    The latest one I got didn’t even say which airline it was from or where I’d be departing from:

    Dear Customer,

    FLIGHT NR: 33283-3644
    DATE/TIME : JAN 27, 2013, 13:12 PM
    ARRIVING AIRPORT: SAN-DIEGO AIRPORT
    PRICE : 945.64 USD

    Your bought ticket is attached to the letter as a scan document .
    To use your ticket you should print it.

    EDITH LESTER,

  19. Robert says

    November 19, 2012 at 11:50 am

    Today I got one claiming to come from Southwest. It didn’t look anything like a real Southwest confirmation — no logo, just plain text with a graphic of a Southwest plane at the bottom. Lamer still, it says I’m going from Salt Lake City, Illinois to PAOLO ALTO, MO, which I don’t think exists. And it identifies the airport in MO as PHX, which is actually in Phoenix, AZ. The line that says “{LET:choosing Southwest for your tour!” is particularly good. The links lead to a hacked WordPress site at mode-yase.com. Bon voyage!

    Here’s the text:
    robert@rlweiner.com 2012-11-19 OB57H9 INITIAL SLC WN PHX0.00T/TFF 0.00 END AY2.50$SLC2.50 4245610957026 2013-11-22 1936 2012-11-20 Depart SALT LAKE CITY IL (SLC) at 8:23 PM on Southwest Airlines Arrive in PAOLO ALTO MO (PHX) at 11:25 PM
    Ready to fly!

    {LET:choosing Southwest for your tour! You can find everything you want to know about your booking below. Happy voyage!

    Upcoming Flight: 11/20/12 – SLC – Phx Knight

  20. Gordon says

    April 11, 2013 at 9:32 am

    This email attacker is still trying. Today it was targeted at staff at a UK University. Our systems recognise the risk (it contains a Trojan virus), and links / attachments are automatically disabled. However, it is clear from previous recipients who have added their names to Robert’s website, that some just don’t understand how the attachment carries a payload that automatically activates if opened. Individuals who don’t work for corporates or government establishments often don’t get the automatic protection that big organisations build into their IT infrastructure. They also fail to get trained in procedures that can minimise risk to their personal systems. This is why attacks are still worthwhile to the scammers. What we really need are stronger controls over domain registrations, email accounts and other facilities that are easily abused.
    In the case of the AA type of scam the guidelines are simple. If you receive an email from someone not on your contacts list and containing an attachment and/ or unexpected offer, then don’t even open it. Bin it.

  21. Rachel carter says

    April 18, 2013 at 3:19 pm

    Got one just now. Said I could download my ticket to Anchorage! Haha, funny part was the “ticket” price was $233.00…not from NC! Stupid spammers.

  22. Paul Y says

    April 19, 2013 at 7:30 am

    How about only $195 to Pittsburgh from London , UK .

    Still too much ?

  23. Moe Staiano says

    December 14, 2015 at 7:09 am

    Got this one this morning and freaked out a bit as I didn’t purchase any ticket, let alone own a credit card:

    “On Monday, December 14, 2015 5:46 AM, America Airlines wrote:

    Dear customer,

    Your payment was successfully processed, your credit card was charged.

    E-Ticket is attached to this email.

    Order details and e-ticket information:

    FLIGHT NUMBER – VG984359
    DATE & TIME – Dec 21 2015, 23:40
    DEPARTING – New York
    TOTAL PRICE – $ 720.00

    Thank you for flying with America Airlines.”

    Tried several times to open the zip file to no avail. Then I realized there is no “America Airlines”. Confused to as why this didn’t go into my SPAM folder.

  24. Robert Weiner says

    December 14, 2015 at 8:19 am

    I’m glad you couldn’t open the Zip file. I can’t think of an airline that sends e-tickets as attachments, much less as Zip files. I’d run a malware scan just to make sure your computer didn’t catch anything.

« Older Comments

Trackbacks

  1. Robert L. Weiner: Nonprofit Fundraising Technology Consulting » Lame spam of the day: Order Confirmation says:
    March 5, 2012 at 8:50 am

    […] spam is similar to the American Airlines Ticket Order message, but much lamer.  It's addressed to "Dear User", doesn't bother to include a human […]

  2. Robert L. Weiner: Nonprofit Fundraising Technology Consulting » Lame spam of the day: US Airways reservation says:
    April 2, 2012 at 8:35 am

    […] 8 of these at 2 different email addresses, always a sign of spam.  The pitch is similar to the American Airlines ticket scam but not as well done.  The U.S. Air logo looks terrible, the formatting is sloppy, all the […]

  3. Robert L. Weiner: Nonprofit Fundraising Technology Consulting » Lame spam of the day: Charter flight reservation says:
    July 6, 2012 at 4:25 pm

    […] looks similar to the American Airlines spam, but lamer.  How many people 1) have secretaries (not me) and 2) charter airplanes […]

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Site Search

Enter search terms

Recent Posts

  • Android factory reset on a Samsung S7: The ugly, the bad, and the good
  • Migrating recurring donors to a new payment processor
  • Idealware’s revised Consumers Guide to Low-Cost Donor Management Systems
  • An Eleven Step Program to Cure Shiny Object Syndrome
  • New book: “Advancement Services: Enhancing Fundraising Success”
  • Robert on the (Internet) radio
  • Robert in the news(paper)
  • What to Do When Technology Isn’t Your Problem
  • Important changes for GiftWorks users
  • Discussion of Donor Data Retention

Blog Posts by Category

Advancement Services Advocacy Alumni Best Practices Blackbaud Cloud Computing CMS Consulting Convio Databases Donor Databases Email Marketing Foundations Fraud Fundraising GMS Grantmaking Hardware IT Management Malware Marketing Microsoft Mobile Communications Nonprofit Management Nonprofit Technology NTEN Online Fundraising Open Source Phishing Privacy Prospect Research Raiser's Edge Salesforce Scam Search Engines Security SEO Social Media Software Spam TechSoup Viruses Web Web 2.0 Wordpress

Footer #Left

This is an example of a widget area that you can place text to describe a product or service. You can also use other WordPress widgets such as recent posts, recent comments, a tag cloud or more.

Footer #Right

This is an example of a widget area that you can place text to describe a product or service. You can also use other WordPress widgets such as recent posts, recent comments, a tag cloud or more.

415-643-8955 | robert@rlweiner.com | San Francisco, CA 94110 | Copyright © 2018 Robert L. Weiner: Nonprofit Fundraising Technology Consulting
** Website design by Leonard Digital **

  • Home
  • Clients
  • Resources
    • CRMs and Donor Databases – Vendors
    • CRMs and Donor Databases – Selection and Strategy
    • CRMs and Donor Databases – Implementation
    • CRMs and Donor Databases – Management
    • Development Operations/Development Services/Advancement Services
    • Email Marketing
    • Newsletters
    • Online Fundraising
    • Online Privacy
    • Social Media
    • Spam
    • Technology Planning
    • Hiring Consultants
    • For Consultants
    • Other Resources
  • Robert Weiner’s Blog
    • Get My Blog Via Email
    • Blogroll
  • About
    • Testimonials
    • Articles by Robert Weiner
    • Presentations by Robert Weiner
    • Robert’s Tweets
    • Services
      • Needs Assessments
      • Vendor Selection
      • Process Improvement
      • Staffing
      • Technology Planning
      • Implementation Support
      • On-Call Advice
  • Contact
This site uses cookies: Find out more.