Full Subscription scam

[Pescebello]

Hello I just got an email from Adobe about a full Subscription I never did and checking on my app it shows I'm a free user.......the email looks genuine so just a mistake or some scam?

 

[kglad]

looks fake because reader is free and no subscription (free or otherwise) is needed.  just go to your app store and install acrobat reader on your mobile.

[John Waller]

message@adobe.com smells like a spoofed email address.

Have you tried viewing the email header to see where it really came from?

[Pescebello]

I posted the picture of the email address and looks like genuine but it was
smelling like s**t =D

[kglad]

you have to examine the email headers and i'm not sure that's possible with your email program on a mobile.  anyway, don't click anything from that email, or at least, don't give any personal info.

[Test Screen Name]

Looking at an email address tells you nothing. It's like reading the name at the bottom of a letter; no proof of anything. Because ANYONE can send email from ANY address. The email header, if you can see it, gives a trace of the servers it came from, and carefully reading the whole chain (NOT being selective) can tell you things, but it's hard.

[Pescebello]

Thank you guys for the support, now I will be more vigilant cause they
always find a new way to scam specially in these hard times 🤬🤬🤬🤬

[kglad]

you're welcome.

[Dj_Creative_enthusiast]

Hi Pescebello,

Thank you for posting your query here.

I would like to inform you that the sender email address is a valid one and all emails regarding "Welcome email" and "Invite User" for Creative Cloud and Document cloud Subscriptions are triggered from the automated mailbox message@adobe.com. And the email is triggered only when there is any activity registered for your email address. 

I would request you to contact Adobe Support Team once and please remain signed in with your same email address before accessing the link  https://helpx.adobe.com/contact.html,  and click chat icon on the bottom-right of the page.   

Hope this helps. 

Thank you.

[kglad]

@Dj_Creative_enthusiast  this paragraph is misleading:

"I would like to inform you that the sender email address is a valid one and all emails regarding "Welcome email" and "Invite User" for Creative Cloud and Document cloud Subscriptions are triggered from the automated mailbox message@adobe.com. And the email is triggered only when there is any activity registered for your email address."

1. the email address may be valid but that doesn't mean the email came from that address nor does it mean the email itself is valid.

2. the subject line of legitimate emails (just like the return address of legitimate emails) is irrelevant and what triggers legitimate emails is irrelevant.

p.s. you should read, https://en.wikipedia.org/wiki/Email_spoofing

[Dj_Creative_enthusiast]

Dear @kglad , 

Thank you for your response. 

I have mentioned in my response to the customer that the email address appears to be valid, however thats not the conclusion to the query and I have requested to contact Adobe Support for a confirmation on the same. 

I feel it is imperative for the customer to get this checked as I have worked with Creative Cloud for Teams Technical Team for over 64 months and I have seen hundreds of similar queries wherein customers feel that they have been scammed, however later on Support Team help them identifies the Orders placed using the same email address, and basis my experience I have requested the customer to contact Support Team once for the confirmation on the same. 

While I do not have much confidence about how Paypal would action against the scam email that you posted and shared with me, I am confident that Adobe has a Fraud prevention Team to take care of such misleading phishing e-mails. They can be reached out at: https://www.adobe.com/trust/fraud-prevention.html 

Thank you. 

[kglad]

@Dj_Creative_enthusiast  for example, here's a scam email i received yesterday:

the fact Ref Id has a typo indicates this is a hopelessly amaturish scam.  ntl, the scammer will probably get that fixed on their next iteration and then checking the mail headers is needed.  though again, this scammer is just starting their career and has a long way to go to get it "right".  they haven't even tried to spoof the from address:

Received: from AM5EUR03HT237.eop-EUR03.prod.protection.outlook.com (2603:10b6:a03:167::14) by BYAPR01MB3800.prod.exchangelabs.com with HTTPS via BY5PR17CA0037.NAMPRD17.PROD.OUTLOOK.COM; Fri, 26 Feb 2021 04:01:31 +0000 Received: from AM5EUR03FT022.eop-EUR03.prod.protection.outlook.com (2a01:111:e400:7e08::46) by AM5EUR03HT237.eop-EUR03.prod.protection.outlook.com (2a01:111:e400:7e08::252) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3890.19; Fri, 26 Feb 2021 04:01:30 +0000

[Tariq Ahmad · Accepted solution]

Hi Pescebello and all,

Sadly, the email, Pescebello, has received is a genuine Adobe email. It was a system glitch.

We are sorry for your inconvenience. Please know that you were not charged for an Acrobat Reader mobile subscription without a purchase. We appreciate your understanding and are always here if you have any additional questions or concerns.

Regards,
Tariq