Hmmm … with myairbp I don’t even get the page to fill-in the credentials.
loco wrote:
I will be clicking some fuel releases next week. I prefer printing releases over using the card.
I am sure you are already well aware, but perhaps it´s different with AirBP web portal when issuing fuel releases, than what you´ve seen before.
While you´re filling in the required details (on the AirBP webportal), there is the option to select the exact amount of uplift requested, and there is also a box available you can tick where the amount remains at pilots discretion. My brief experience with AirBP fuel releases (in private flying capacity!) is that you´re best of by ticking the box with pilots discretion, and simply leaving the “amount” blank. If you pre-fill the amount and you want (expect) and you decide to want additional uplift, this may become “complicated” at some locations.
Air BP emailed me last week to say they’re doing an account update and, for reasons they haven’t explained, they need to know my mother and father’s names and my date and place of birth. I can’t fathom why they need that information to deliver fuel to an aircraft.
The email seems genuine – it comes from the BP Sterling email address and has my account number in it.
Has anyone else had this?
imperialsam wrote:
Has anyone else had this?
I have not. I’d be careful. Sounds very strange.
NO that is BS. Do not respond.
AIR BP have already had some fraud, presumably due to database theft.
Check email headers. Most people do emails on phones which is dreadful in that the full addresses are usually not shown unless you do some extra work. The From: Reply-to: and To: headers are usually revealing.
I bet you the Reply-To is not the BP address. Can you post the headers? Nowadays one must have a means of checking headers to pick up dodgy emails, plus an ability to examine HTML attachments as text (in Notepad, etc, not in an editor which interprets HTML).
Now, this will be controversial, but anybody in a “business” who is sending HTML-only emails is very likely to be a scammer. HTML emails make it easy to scam people. In business, unless you are in the “art/design” sphere (and live for the day, etc) emails should be plain text, no HTML. Exceptionally, plain+html is okay but I find the probability of it being scam is elevated 10×. At work I use an email program from 1995 which does not execute HTML.
Thanks. I’ve sent you the headers in a private message Peter, partly as they’re very long and partly as I’m not sure if there’s anything else identifiable in there that I wouldn’t want to be posted on a public forum!
Thanks. I am not expert enough to decipher all of it but I can’t see anything obvious. DKIM passes, so they could not have used a forged From: header. So I reckon the exploit is embedded in the HTML of the email body.
I had trouble getting on to their new interface and within an hour of mailing them I had a Teams call with a support guy in Albania who was very interested in my problem which appeared to be that you have to type CR at the end of a new password. I’m fairly sure he was legit but after reading this….
Air BP sterling card received. Valid for one year, until May 2025.
