I have a page up top for listing contact information for reporting phishing e-mails. SunTrust Bank, however, has their e-mail server set up in a rather weird way. I’ve tried forwarding an e-mail to them numerous times and keep getting this in response:
554 Unfortunately your access to this mail system has been rejected due to the sending MTA’s poor reputation and e-mail hygiene on the Internet. Please reference the following URL for more information: http://www.senderbase.org
When I took to Twitter to figure out an alternate way of forwarding them the phishing e-mail, they subscribed to me and said to forward screenshots of it via DM. Screenshots. Yeah, no. Thankfully I was actually able to forward the e-mail to them from a yahoo.com account. Let that sink in for a little bit…
So if someone from SunTrust happens upon this article, please have your IT department do something about your mail server. You cannot publicly advertise an e-mail address for forwarding phishing e-mails that rejects good faith attempts to provide said e-mails to you. I’ve never had an e-mail rejected due to some arbitrary “reputation” score.
At the least, set up a contact form that allows attachments with instructions on how someone can export an e-mail to a .eml file so the entire e-mail can be sent to you intact. Forwarding takes away a lot of potentially useful information, such as the originating mail servers. And screenshots are basically useless. Including screenshots of the raw e-mail unless you have an OCR program at the ready or are willing to manually recreate the e-mail by hand from the screenshots.
To everyone else seeing this, a quick reminder: your bank will almost NEVER contact you via e-mail if there is a problem with your account. They will instead call you since they have your phone number on file. And if you notice anything odd about your account, call in or visit a bank branch in person.
