Old news to me

As the IT manager for a web dev company, I get emails like this all the time. And they all get referred to the authorities for action. Since many of our clients have commercial sites which process credit card purchases, I am very aware of the unrelenting and varied attempts by these scumbags to get into our sites to milk the credit card details.

Thus I have in place a very strict security policy which, among other things, includes all IT staff never clicking on any link in any email - on pain of immediate termination. Nor is any related information ever to be given out over the phone, no matter who the caller claims to be (and we've had some good ones!). Nor is anyone other than staff permitted into the development area, not even staff family members. No slash card - no entry. And USB sticks are forbidden in there as well.

Access to our host is done only through designated machines (which are not used for any other purpose than transferring data to and from our websites) via SSL and the URL, usernames and passwords must be manually typed every time. We also clear and restore each site from a local read-only backup at the end of each day in case any of our server-side scripts are hacked (by whatever means known or unknown).

Any webmaster worth his degree will have similar policies and procedures in place, ESPECIALLY if you are running credit-card processing sites. Not doing so is courting disaster, because these scamming bastards WILL find you, and the smaller web dev companies are their favourite targets.