A phishing scam impersonates Boulanger and offers you thousands of euros.

A new phishing campaign impersonating Boulanger, on the pretext of cancelling an expensive order, is attempting to steal your personal data.

 

What would the holiday season be without a good phishing campaign?

The message received by Alain Michel was made to look like confirmation of a purportedly expensive order (nearly €1,000) from the Boulanger store.

Far from one of those hastily put-together scams.

Unfortunately for the cybercriminals, Alain Michel is a trainer in the educational technology sector and immediately spotted the scam. Apart from his email address, the other information contained in the message (name and postal address) was not his.

The email address is “noreply@confirmationsboulanger.com”, with a domain name that should at least raise suspicions (even though companies sometimes use different domain names for their customer service).

An unsuspecting user could easily believe that it is an authentic email and click the red link offering to cancel the order.

“I noticed it late yesterday afternoon, so it was taken offline during the afternoon [of 30 December 2021],” he told Numérama.

“But I am sure there will be others.”

 

A perfect copy of the Boulanger website

The link led to an almost perfect copy of the Boulanger website.

However, the link has since been disabled, perhaps thanks to the Pharos report that Alain Michel says he filed: “I realised that this does not only affect customers […] Cybercriminals create databases and then impersonate administrators.”