How to differentiate between legitimate ecard email and a fraudulent email?

At a quick glance after reviewing the table below, you should be able to tell the difference between legitimate ecard email notifications and emails not from us. However, we still recommend that you manually type in https://www.123greetings.com and in the search box put in the 20 digit ecard number provided in the email to view your ecard to ensure complete safety.

Legitimate 123Greetings.com ecard Emails Fraudulent ecard Emails
Subject Line

(SENDER_EMAIL) has sent you [a/ an] [birthday/ anniversary/ event name] ecard from 123Greetings.com. Reminders to pickup your ecard will have the following subject lines:

  1. Reminder: < SENDER_EMAIL > has sent you < a/an > [birthday/ anniversary/ event name] ecard.
  2. <Number of ecards> cards pending for you.
  3. Reminder: Your card from < SENDER_NAME > is waiting for you.
  4. Reminder: You have [number of cards] cards waiting for you.
  5. Reminder: < SENDER_EMAIL's > ecard is still waiting for you.
  6. Reminder: < number of cards > ecards are still waiting for you.
  7. Reminder: Last chance to view your cards

Subject line varies. Examples include:

  • You Have Received a Greeting ecard from 123Greetings.com
  • You've received an ecard from a class-mate!
You've received a postcard from a family member!
"From" 123Greetings.com [ecards@123greetings.com]

"From" varies. Examples include:

  • 123greetings.com [mailto:ht@grbdll.com] (note that the email address is random)
  • Personal email address
  • services@123greetings.com
Email Message The sender's name and email address is always in the body of the email. You should personally recognize this individual before engaging further in the email. May or may not include random individual's name and email address.
Links in Email Ecard pickup link will always include 123greetings.com as the start of the URL. In addition, we will never send you an EXE file. If your email contains a clickable URL that is an EXE file, do not click on it. Ecard pickup link does not start with https://www.123greetings.com, but instead shows a series of numbers (commonly referred to as an "IP Address"). Sometimes the IP address is hidden and can only be seen by hovering your cursor over the link or right-clicking on the link to view Properties. May or may not include a clickable URL that is an EXE file.

How to differentiate between legitimate ecard link and a phishing link:

Hovering around your mouse-cursor over the legitimate ecard link will display the https://123greetings.com/send/view/[20_Digit_Ecard_Number] in the status bar at the bottom whereas the phishing ecard email link will display an IP or some other website in the status bar.



Article ID: 166
Last updated: 29 Aug, 2018
Revision: 1
Legitimate Emails -> How to differentiate between legitimate ecard email and a fraudulent email?
https://help.123greetings.com/how-to-differentiate-between-legitimate-ecard-email-and-a-fraudulent-email_166.html