United Elite Choices?

Today I got an email regarding me reaching the 2006 Elite Choice 40K
milestone and directing me to a website
https://www.2006elitechoice.com/...
to choose my reward.

I am a bit leery, afraid that this could be a phishing attempt, as I do
have to enter my password at that site too.

IMHO, it would be much better if such additional webpages were hosted
under the www.united.com URL too, so that it's easier to be sure that
they are not malicious attempts to collect passwords.

so, is that URL 2006elitechoice.com legit?

M

Mathias Koerber wrote:
Today I got an email regarding me reaching the 2006 Elite Choice 40K
milestone and directing me to a website
https://www.2006elitechoice.com/...
to choose my reward.

I am a bit leery, afraid that this could be a phishing attempt, as I do
have to enter my password at that site too.

IMHO, it would be much better if such additional webpages were hosted
under the www.united.com URL too, so that it's easier to be sure that
they are not malicious attempts to collect passwords.

so, is that URL 2006elitechoice.com legit?


Does UA advertise a 40K reward?
Did you recently pass 40k?

You SHOULD direct a query to the MileagePlus people

mrtravel said the following on 19/7/2006 16:42:
Mathias Koerber wrote:

Does UA advertise a 40K reward?
In some places yes, though that page does not seem to be readily
findable from the main www.united.com page (even after login).

Did you recently pass 40k?
yes, but then there is a chance that someone learnt that fact
and created the phishing email before United would have
(knowing that United is not very fast with most Mileage
related processing)

You SHOULD direct a query to the MileagePlus people

I did.

A reply came from (apparently but Received: headers indicate USA.net)
:

Hello Mr. Korber,

Thank you for being a loyal Premier Executive member.

The web address to make your choice is valid and you will need to enter your
password. I have included the terms of the promotion for your below.

Mileage Plus members who earn Premier Executive status March 1, 2006 or
later in 2006 are eligible to register for a promotion that provides even
more rewards for their status and the number of Elite Qualifying Miles (EQM)
or Segments (EQS) earned during the year.

Four milestone marks have been established for the promotion and when
members meet each of the milestone marks, they will be sent an e-mail
inviting them to choose their reward online.

Members must register for the promotion by December 15, 2006 at
www.united.com/optionD26. Members must also have a valid e-mail address in
their profile and select the option to receive "Mileage Plus
communications." For details regarding milestone marks and awards
associated with each of those marks, as well as terms and conditions for
this promotion and the rewards, please visit the website at
www.united.com/optionD26.

I appreciate your taking the time to contact me.

The interesting point here is that the webpage they mention
(www.united.com/optionD26) does no longer exist.

A call to the Mileage Plus phone support resulted in the following URL
www.united.com/pickw56 which does in fact contain that information
(but again no mention of the 2660elitechoice.com URL).


My reply to web-mpi.united.com:

[...]
Right. thanks for clarifying. Yet, it is strange that


b) the domainname united uses is not registered to United but someone
called Grey Direct Chicago.

| $ whois 2006elitechoice.com
| [Querying whois.internic.net]
| [Redirected to whois.register.com]
| [Querying whois.register.com]
| [whois.register.com]

[...]
| Registrant:
| Grey Direct Chicago
[...rest if WHOIS snipped...]

[ ...snipped the part advising me of www.united.com/optionD26...]

That URL (www.united.com/optionD26) also doesn't exist anymore and I get
a 'we have redesigned our homepage' message. I cannot find the signup
page at all.

(one of your colleagues in phone support mentioned
www.unted.com/pickw56 which does have the correct information on this
program, BUT also doesn't mention that making a choice requires one to
to go to a NON-UNITED-owned webpage where one has to leave one's
password)

All this makes me think that either the email I got is still bogus,
or that United is doing a bad job of communicating the program details.

In this day and age of phishing (directing unsuspecting users to forged
webpages to collect their login credentials for later abuse of their
accounts), companies like banks and also member-programs should ensure
that either they use only webpages that clearly are correct (such as
keeping the sites all under www.united.com/...), or clearly mentioning
the fact that a foreign webpage is to be used on their own homepage, and
then clearly identifying which page that is.

regards
Mathias