Scare Tactics and Action Items to Trick You

Emails that come across with scare tactics like this recent email (below) are pretty easy to research.  Use of words like subpoena and action requests like "Please prepare the documents" are designed to make you click on the document without questioning whether you should. 

I did a quick search for WEX Inc subpoena and the first search result was a malware report: 
http://www.malware-traffic-analysis.net/2017/05/10/index2.html

The cool thing about websites like Malware-Traffic-Analysis.net is that they do the dangerous clicking for us and they are rather quick to post their findings. If you follow the link above you'll see the research they did on the malware and what it does.  The downside is that they don't spend much time explaining their findings to the regular Joe.  It makes sense to me, but I have spent 24 yrs in IT. 

You'll notice my client received this email on May 10th and the Malware post about the fake emails was also posted on May 10th.  If you're not sure about whether to click on a link or an attachment in an email, you can always wait a day to see of a malware report is posted.

In lieu of a malware report this email still fails the checks I recommend that every small business owner practice noticing about all emails they receive. These checks are:

1. Do you know the sender? - In this case the answer was no, but because it is claiming to be a subpoena, the client figured they wouldn't know the sender.  If you don't know the sender begin to be suspicious.
2. Does the name in the email address match the name in the name in the signature block? - In this case no.  
3. Are there inconsistencies? Yes! Aaron is not James although they share the same last name.  Also the subject line implies that the email was forwarded, however, the forwarded email header information is missing in the body of the email.