MainSleaze

Capital One, a bank with an aggressively-advertised credit card program, just sent a bulk email advertisement to a spamtrap that has never heard from Capital One before. Worse, the email uses a name that was never associated with that email address when it was live. So how did Capital One acquire that name and email address combination? One spamtrap hit isn’t conclusive, but this smells very much like a bad e-pend to me. The ESP is Epsilon Interactive, via its subsidiary Bigfoot Interactive.

In addition to the issue of sending rather blatantly opt-out spam, this email is troubling because it was sent by a bank to an individual whom it had no reason to believe was at the email address in question, and provided the individual with private access codes that anybody who happened to receive that email could use to access a credit offer. I did not use those codes, of course, but it appears from here that I could have opened a credit card in the name that Capital One incorrectly associated with this email address. Has Capital One not heard of identity theft?

I am not a Capital One customer. After seeing this, I doubt that I will ever be a Capital One customer, and certainly not unless I have reason to believe that Capital One has cleaned up its marketing and security houses considerably.

Sending IP: 216.33.63.64

Spam Sample:

Actual Headers:

Received: from bigfootinteractive.com (arm-ei64.bigfootinteractive.com [216.33.63.64])
        by <xxx> (Postfix) with ESMTP id <xxx>
        for <xxx>; Wed, 25 Apr 2012 14:xx:xx <xxx>
DKIM-Signature: <xxx>
DomainKey-Signature: <xxx>
Received: from [192.168.xx.xx] ([192.168.xx.xx:xx] helo=<xxx>)
        by <xxx>.epsiloninteractive.com (envelope-from <<xxx>@email.capitalone.com>)
        (ecelerity 2.2.2.45 r(34222M)) with ESMTP
        id <xxx>; Wed, 25 Apr 2012 15:xx:xx <xxx>
Reply-To: =?iso-8859-1?B?<xxx>?= <<xxx>@email.capitalone.com>
Bounces_to: capitalone.<xxx>@email.capitalone.com
Message-ID: <<xxx>.DumpShot.<xxx>@email.capitalone.com>
X-SS: <xxx>
X-BFI: <xxx>
Date: Wed, 25 Apr 2012 15:xx:xx <xxx>
From: =?iso-8859-1?B?<xxx>=?= <capitalone@email.capitalone.com>
Subject: <xxx>, you're eligible for this cash rewards offer with no annual fee
To: <xxx>
MIME-Version: 1.0
Content-Type: multipart/alternative;
  boundary="<xxx>"

Readable Email:

From: <xxx> <capitalone@email.capitalone.com>
To: <spamtrap>
Subject: <xxx>, you’re eligible for this cash rewards offer with no annual fee

Capital One(SM)
http://email.capitalone.com/<xxx>

Apply now for a Capital One(R) Cash card.
http://email.capitalone.com/<xxx>

<removed>

SUPERSIZE YOUR CASH

50% MORE cash back–with no annual fee

Special offer for <e-pended name removed>

If you like more cash back every year without an annual fee, this Capital One(R) Cash rewards card is made for you.

Please visit
http://email.capitalone.com/<xxx>

<removed>

Act now using your personal codes below before this offer expires on May 3, 2012.

Apply Now at
http://email.capitalone.com/<xxx>

Reservation #:
<obviously personalized number redacted<

Access code #:
<obviously personalized access code redacted<

You can choose to stop receiving “prescreened” offers of credit from this and other companies by calling toll-free 1-888-5-OPT-OUT. See PRESCREEN AND OPT-OUT NOTICE below in Important Information from Capital One for more information about prescreened offers.

<removed>

Capital One and its service providers are committed to protecting your privacy and ask you not to send sensitive account information through e-mail. If you are not a Capital One customer and believe you received this message in error, please notify us by responding to this e-mail.

PRESCREEN AND OPT-OUT NOTICE:
This “prescreened” offer of credit is based on information in your credit report indicating that you meet certain criteria. This offer is not guaranteed if you do not meet our criteria. If you do not want to receive prescreened offers of credit from this and other companies, call the consumer reporting agencies toll-free, 1-888-5-OPT-OUT (1-888-567-8688); or write them individually at: Experian Target Marketing, P.O. Box 919, 701 Experian Parkway B2, Allen, TX 75013; Equifax Options, P.O. Box 740123, Atlanta, GA 30374-0123; Trans Union Corporation, Attn: Marketing Opt Out, P.O. Box 505, Woodlyn, PA 19094-0505.

<removed>

Products and services are offered by Capital One Bank (USA), N.A., Member FDIC. Copyright 2012 Capital One. Capital One is a federally registered service mark. All rights reserved. 15000 Capital One Drive, Attn: 12038-0111, Richmond, Virginia 23238. To contact us by mail, please use the following address:

Capital One, PO Box 30285, Salt Lake City, Utah 84130-0285.