#AXP AUDIT EXPRESS SOFTWARE CODE#

After providing login information to the phony American Express page - and regardless of whether the login information is correct - users are presented with real- looking pages for them to enter card numbers, card expiration dates, card four-digit CVV code, their Social Security numbers, birth dates, mothers' maiden names, mothers' birth date, date of birth, and email addresses. While the lack of HTTPS should also alert some people to the likelihood of something amiss, and any browser that colors URL bars based on the use of encryption will obviously not do so in this case, as I discussed in a paper co-authored with Shira Rubinoff a decade ago, many people focus entirely on the contents of browser windows and do not pay attention to security clues in browser infrastructure. The email contains a link on the bottom to 'Create a PSK' - and users who click the link are directed to a phony American Express login page on a site at the legitimate-sounding (it is hard to notice the spelling error - did you?).

#AXP AUDIT EXPRESS SOFTWARE CODE#

The email is well written and formatted like an American Express email unlike some of the prior versions, it contains no mislabeled links (i.e., links whose text description contains link code that does not match the actual link). In the new scam, targeted users receive an email message allegedly from American Express (in at least one variant the return address appears to targets as advising the recipient to protect him or herself from fraud and phishing by establishing an 'American Express Personal Safe Key (PSK)' to improve the security of their accounts.

Axp audit express software