Alibaba merchants are asked to be aware of phishing email messages like the one below, which claim that they have received an order. The link in the fake or phishing email message goes to a fraudulent Alibaba website that tricks merchants (people selling on Alibaba) into signing in, in order to view and confirm their so-called order. But, once the merchants attempt to sign-in to the fraudulent website, their Alibaba credentials (usernames and passwords) will be sent to the cybercriminals behind the scam or phishing website.
Sample of the "Alibaba Notification - Manage Your Orders" Phishing Scam
Subject: Alibaba Noification
Lisa from Malaysia placed an urgent order with you
You have received a message from Park on Alibaba.com
Lisa
Graudbert Tongher Co., Ltd. Gold Member
Dear,
We're pleased to let you know that Lisa from Malaysia has placed an order with you.
You can sign in Alibaba Trade Center Below to confirm the order.
View Orders
Manage Your Orders
NOTE: You received this email because you are registered on Alibaba.com.
Once the cybercriminals have received their potentials victims' Alibaba credentials, they will use it to gain access to their accounts, hijack and use them fraudulently. Therefore, Alibaba merchants who were tricked by the phishing email message should change their Alibaba account password immediately and check their accounts for any descrepancies.
This is why Alibaba's merchants or customers should never click on a link to sign into their accounts, they should go directly to www.alibaba.com and sign-in from there instead. This will prevent them from visiting phishing websites that steal online account credentials, personal and financial information.