ACH related messages
ACH cancellation report
ACH payment report
ACH rejection notice
ACH transaction declined
ACH transaction suspended
ACH transfer rejected
ACH transfer not accepted
ACH transfer suspende
The email is send from “The Electronics Payment Association” with a spoofed emailaddress in the form of 52F54A1@domain.tld (random numbers and letters in capitals) in and has the following body:
The ACH payment ID: #ACH672038492554US, that had been sent from your banking account recently, was suspended by the recipient.
ACH rejection notice Transaction ID: #ACH672038492554US Details: please refer to the report below for more information Transaction Report report_#ACH672038492554US.doc (Microsoft Word Document)
13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
2012 NACHA – The Electronic Payments Association
ADP related messages
ADP Generated Message – Debit Draft
ADP Funding Notification – Debit Draft
ADP Urgent Notification – Debit Draft
Message from ADP – Your bank account will be debited
Message from ADP – Your Transaction Report
The email is send from “ADPClientServices” with a spoofed emailaddress in the form of 9021ACB88@domain.tld in and has the following body:
Your Transaction Report(s) have been uploaded to the web site:
Please note that your bank account will be debited within one banking business day for the amount(s) shown on the report(s).
Please do not respond or reply to this automated e-mail. If you have any questions or comments, please Contact your ADP Benefits Specialist.
ADP Benefit Services
At this time, it apperars that this page is empty. Our investgation with online HTML viewers and opening the web page directly shows us no content. But the technique used here is the same as in the previous campaigns with messages from ADP. It is possible that the URL will change or that the malicious code will appear at a later time.
MX Lab recommends therefore not to click on the embedded URLs in this type of messages.