To whom it may concern,
Please check the attached swift copy of payment and kindly confirm receipt of payment with your bank.
(No, I didn't open the attachment!)
One is entitled "Confirmation Slip" sent from a "Firew Kefyalew", but signed "Mr Firew Mekonnen, U.S. Office
Accounting Department, International Institute of Rural Reconstruction". The differences in the names got my attention.
The second was entitled "Payment Slip" and sent and signed by "Mr Getachew Tamiru".
The web address listed in the e-mails (iirr.org) is for a group that provides educational and farming assistance to impoverished regions, and both messages had US mailing addresses and telephone numbers. Anyone know anything about this?
ADDENDUM: I ran "Please check the attached swift copy of payment and kindly confirm receipt of payment with your bank." in a web-search and found a number of warnings from CISCO about the attachment being a Trojan Horse for malicious software.
https://tools.cisco.com/security/center ... rtId=40056