When a small plumbing company in Monroe, Louisiana, got an email yesterday from BBB saying they’d had a complaint filed against them, they took it seriously. After all, the company is a BBB Accredited Business and the owner serves on the board of directors of BBB of Northeast Louisiana.

What they got, however, was much worse than a complaint from an unhappy customer. The email was a fake, a phishing scam that downloaded viruses on two of the small business’s computers, which had to be wiped clean in order to get rid of the malware infection. Fortunately for the plumbing company, the virus hadn’t had a chance to steal any banking information.

Unfortunately, small businesses and consumers across the country are falling victim to the latest phishing scam that exploits BBB’s trusted name. The campaign that started yesterday was the second biggest phishing scam in the country on Wednesday, according to the University of Alabama at Birmingham’s Spam Data Mine, one of the nation’s foremost computer forensics labs. SDM is assisting the Council of Better Business Bureaus in tracking phishing scams that use the BBB name.

The phishing emails – the fifth wave since Thanksgiving that uses the BBB’s name – uses BBB’s name and logo in an attempt to look like a notice of a newly filed complaint. The latest round includes a ZIP attachment, but that has not always been the case. Whether by an attachment or a link, the phishing emails attempt to trick the recipient into clicking and opening the “complaint,” which downloads malware onto their computer. The malware is designed to infect the computer and look for information such as bank account numbers and passwords in order to steal money from the recipients’ accounts.

If you receive an email that looks like it is about a BBB complaint:

1. Do NOT click on any links or attachments.
2. Read the email carefully for signs that it may be fake (for example, misspellings, grammar, generic greetings such as “Dear member” instead of a name, etc.).
3. Be wary of any urgent instructions to take specified action such as “Click on the link or your account will be closed.”
4. Hover your mouse over links without clicking to see if the address is truly from bbb.org.
5. Delete the email from your computer completely (be sure to empty your “trash can” or “recycling bin,” as well).
6. Run anti-virus software updates frequently and do a “full system scan.”
7. If you are not certain whether the complaint is legitimate, contact BBB (www.bbb.org/find).
8. Forward the email to phishing@council.bbb.org so that our security team can track the perpetrators.  If you receive a “bounce” message, there is no need to resubmit.

BBB of Southern Arizona also recommends that all businesses take steps to secure their data and the information they’ve collected on their customers. BBB’s “Data Security – Made Simpler”

Better Business Bureau of Southern Arizona is warning consumers that feedback and reviews of products and services are not all they are cracked up to be, and in many cases, might be misleading.

“People turn to consumer reviews to find out what others’ experiences are like,” said Kim States, BBB President.  “Unfortunately, there is evidence that some online feedback is planted.”

Professional writers can stack websites with positive comments about a particular company’s products or services – or negative feedback about their competitors.  Because of this, the consumer review landscape is often not what it appears to be, and comments must be taken with a grain of salt, whether on retail, travel or services websites.

In one case, a Wall Street Journal reporter plugged the name of a reviewer into a search engine and discovered the “consumer” was in fact employed as a communications manager at the company whose product she was praising.   In other cases, similar or identical language has been used for various products made by the same company on different websites.

Online retail giant Amazon has a policy that prohibits “positive reviews for products in which the author has a financial investment.”  Aside from company staff members and marketers, freelance writers are paid for each review they post that praises or trashes a company or its competitor.

While a great deal of online customer feedback is reliable, BBB urges consumers to consider several things when evaluating product and company reviews:

It is all in the name – Reviewers’ names that include two or three numbers at the end are often signs of robotic review-writing software.  In addition, some fake reviews can be spotted if the reviewer’s name resembles a business or product name.

Watch out for glowing subject line and verbiage – Most consumers won’t use subject lines such as “This product changed my life.”  Another giveaway is the repeated use of a product’s complete name and detailed description, such as “The XYZ Model 443 XZ outperformed all other television sets in its category.”

Unusual sentence structure – If the review is awkwardly worded, vague or praises its maker’s company, it may be planted.  Cut and paste suspicious sentences into a search engine and see if it comes up on other sites.  Does the feedback resemble an ad or review from a real product user?  Consumer reviews that read like product descriptions in catalogs and websites probably are.

The marketing is in the message – If the review exudes blind product loyalty, uses marketing phrases such as “integrates seamlessly,” or “this is the kind of product that you’ve been looking for,” it was likely written by someone who is pushing the product.

Black or white reviews – While a consumer may have strong opinions for or against a company or its products, take a second look at any feedback that is excessively positive or negative.  Once you understand how companies and hired reviewers work, you can often detect a feedback piece with a hidden agenda.

Long-winded reviews with “life changing” testimonials tend to raise suspicion.  However, there is no guarantee a short consumer feedback post is legitimate either. The best way to get a feeling for a product is to read reviews from a variety of sources, and look for any pattern in feedback on a single site. Friends on social networking sites can be a good source for leads.

The more you read about the product and company, the better you will be at judging whether you are reading legitimate comments or meaningless marketing disguised as consumer experience.

Better Business Bureau of Southern Arizona is warning businesses of a scam email that appears to be from BBB, but actually contains malicious links, and seeks to trick businesses into divulging sensitive information.

The “phishing” email, signed “Accreditation Services,” seeks to trick victims into filling out an online form that asks for detailed information about the business. Because the links contained in the email may contain viruses, anyone who clicks on them should immediately scan their computer with updated anti-virus software.

Should you receive such an email, please disregard its message, and report any information received to phishing@council.bbb.org, and then delete it.

Below is a copy of the scam email. BBB has deactivated all the possibly malicious links:

“Thank you for supporting your Better Business Bureau (BBB). Your BBB receives more than 6,500 requests for information every day and provides reliability reports to consumers 365 days a year, 24 hours a day, and 7 days a week.

As a service to BBB Accredited Businesses, we try to ensure that the information we provide to potential customers is as accurate as possible. In order for us to provide the correct information to the public, we ask that you review the information that we have on file for your company. (more…)