This arrived in my mailbox.
Date: Thu, 16 Jan 2020 07:53:44
From: G.O.V. UK <firstname.lastname@example.org>
To: xxx <email@example.com>
Subject: Your latest vehicle tax payment failed ID - 4609441314363
Our Reference: 7399096
Your latest vehicle tax payment failed. It appears that some of the billing
details associated with you might have expired or were otherwise changed.
On behalf of the Secretary of State for Transport
At first glance, it looks plausible. But what is the "lxlyeAnPD"?
And why is this email apparently coming from amazonaws.com? And what is that web address? And G.O.V. UK would have looked better as "Vehicle Tax".
So I checked the header; the email came from masterhost.smart-soft.ru, which is Russia!
And the address of the web site is ... Vietnam.
So, it's some sort of scam, and I'm guessing that if I were to go to that web address, it would want my credit card details, so they can bill me for vehicle tax.
So, nice try, but no banana.
If only they had used a spoof address that was gov.co.uk (it's VERY easy to spoof the from address). And they should get rid of the "lxlyeAnPD". And use a more plausible web site address, or an URL shortener so the site address isn't obvious.
Incompetence. Incompetence everywhere, even in the scammers.