Beware of scam emails from Nordstrom

Mar 26
2 min read

The bad guys are at it again. This time they hacked Nordstrom's email servers and sent crypto scam emails to customers disguised as a St. Patrick's Day promotion. Here's what it looked like:

The problem is that these emails came from nordstrom@eml.nordstrom.com, an official address the company uses to send marketing, sales, and promotional communication. So this passes the human shield test and makes it far more convincing.

The Takeaway

Soon after these emails went out Nordstrom sent a follow up email stating that it was "unauthorized" and that they were investigating, but that was about the end of it. So what do you do when a trusted source of communication like Nordstrom gets hacked?

Don't trust an email just because it came from a real company address. In this Nordstrom case, the scam was sent from a legitimate address, which is exactly why this type of attack is dangerous. In the future, treat the content of the message as the real test. If its asking for money, crypto, gift cards, urgent action or anything unusual, assume it's a scam until you can verify it another way.
Be suspicious of urgency and “too good to be true” offers. The scam promised to double any cryptocurrency sent within two hours, a classic pressure tactic designed to make you act before thinking and out of greed. Scammers love excitement and panic as it overrides common sense, so slow down if a message creates urgency or promises easy money.
Verify using a separate, trusted method before doing anything. Instead of clicking on a link inside the email, go directly to the company’s website, open its official app, or contact customer service using a number or link you find yourself (NOT one inside the email). Never use the suspicious message itself to confirm if it is real.