I am a bit surprised that this hasn’t received a bit more exposure in the mainstream media but there has been an ongoing scam being conducted on MySpace that involves the Macy’s brand.

In a nut shell, the scam works like this:

Phase I: Phishing for Credentials

1. The scammer (I think they are called PromotionalPalace) somehow acquires a MySpace users credentials.
2. They then send out a mass e-mail from the MySpace user’s account to all his/her friends, saying intriguing something like “I can’t believe that _______ put those pictures up.”
3. There is a hyperlink from ‘those pictures’ that directs the MySpace user to a fake MySpace page that prompts them to log-in with their credentials before proceeding.
4. The credentials are then captured by the scammer and the MySpace user enters back into the normal flow of MySpace, confused about what just happened (Note: if MySpace wasn’t so buggy to begin with people might be a bit more suspicious after this just happened to them).

Phase II: The Scam

1. Once the scammer has collected a large volume of credentials, they launch their scam campaign. This involves logging into the various MySpace users’ accounts and then posting an advertisement on all that user’s friends’ pages. Here is what the ad looks like:



2. This ad direct to a site where the scammer then asks the MySpace user to register their e-mail and postal address before ‘receiving’ the Macy’s card. I can only assume that PromotionalPalace then does something else with that information but I don’t know what because I didn’t feel inclined to fill out these fields and register for this card.

At any rate, what happens from that point forward is of only mild interest to me. According to Wikipedia, some sort of Trojan Horse virus is placed on your computer but I don’t really know.

What is of real interest to me is that as far as I can tell, Macy’s hasn’t really responded to this situation. One blogger even went so far as to provide them with an analysis of the scam but so far, I haven’t read anything from them that addresses the scam.

In the words of the blogger who wrote the aforementioned report, “Macy’s brand has become a joke on MySpace.”

Whether or not that is true is up for debate, but what is not up for debate is that Macy’s really needs to get on this one because the longer this goes without any sort of response, the more damage there will be to their corporate reputation and their brand.