Emails from Digikey in Chinese "customer excellence program"

[Whales]

Today I received a couple of emails in Chinese from e.digikey.com, both identical except for the TO: address.  For reference: I only ever order on digikey.com.au (Australia, English):



Via Gtranslate:

Digi-Key Customer Excellence Program
As an important customer, we hope to give you thousands of products at exclusive discounts through the Digi-Key Customer Excellence Program.

You will get:

     Full discount
     Future exclusive services, such as payment on credit


No other actions are required! Shop now and enjoy the experience!

These emails were addressed to me using a digikey-dervied datasource, specifically an order I made on 2019-01-14 and and order I made on 2021-01-28.  I use a unique email address for every purchase I make (I own my domain and I have it setup so anythingyouwant12345678@mywebsite.com gets to me) so I know if anyone sells or loses my email address to a spammer.  Each address I make up contains a long random number and I note it in a file along with the date & URL it was submitted to.


The real question is: are these legit emails from Digikey or phising scams using Digikey's data?

I rang Digikey this morning and was told very directly to "delete them", that they have been getting lots of calls this morning about it and e.digikey.com is not a legitimate sender from them.  They say they already have their IT looking into it and thankyou for calling them about it.

  At this point I don't think they're necessarily phising emails from digikey-sourced data, I think it could be a sales guy at the Chinese digikey office using their dataset.  All of the links in the email go to c.digikey.com; but there is still a chance I'm missing something, I have not read its full source, so don't take this as security advice.  Treat it as phishing until further notice from Digikey.

[ataradov]

They are legit. Someone screwed up. This is their new agile approach to development showing itself. If they were phishing, they would not lead to a legit site. There is not a link in that email that goes to some suspicious place.

The fact that they spam at all is bad, but may be in China it is more acceptable.

I would prefer to not receive any communication from companies that is not directly related to may order.

[Bud]

Digi-Key Customer Excellence Program
As an important customer, we hope to give you thousands of products at exclusive discounts through the Digi-Key Customer Excellence Program.

You will get:

     Full discount
     Future exclusive services, such as payment on credit


No other actions are required! Shop now and enjoy the experience!

Never in my buying from Digikey i ever got a 1 penny discount. Either this is BS or i am not an important customer 
And what the heck is "Full discount", though it may be a translation quirk.

[beanflying]

Yep I was cleaning out my spam folder just before and Oscar was 'ere too  I suspect it is because us Aussies to the Yanks are in their Asian area but 

[ataradov]

Never in my buying from Digikey i ever got a 1 penny discount. Either this is BS or i am not an important customer 
And what the heck is "Full discount", though it may be a translation quirk.

That's why it was intended for Chinese market.

Also, it looks like DigiKey China operates much the same way as everything else in China. I checked prices for a few items, and they are higher than US prices. Not sure how that makes any sense. So may be that's why they decided to graciously discount them to at least the US prices

[newbrain]

I rang Digikey this morning and was told very directly to "delete them", that they have been getting lots of calls this morning about it and e.digikey.com is not a legitimate sender from them.

As it often happens, they did not know what they were talking about.

I got the mail (went straight to spam on my gmail account) but as it used as specific +xxxx gmail address (not the same I use for DK orders), I could trace it back to when exactly they got my address.
It was when, some years ago, I signed up for PADS Maker Free, and the capture below is a part of their announcement that it had been discontinued. The e.digikey.com looks legit.

Moreover, if a spammer could hijack a valuable domain as xxx.digikey.com, I would be seriously worried.

[Whales]

Moreover, if a spammer could hijack a valuable domain as xxx.digikey.com, I would be seriously worried.

Often you don't need to hijack anything at all, just spoof the sender.  Systems like DMARC/SPF/etc are supposed to prevent this, but the results vary quite a bit.

[Microdoser]

Yeah, I got one of those early this morning as well.

[edpalmer42]

I got one too.  When I get a suspicious message like this, I look at the raw text of the message and headers.  One thing I saw was:

Code: [Select]

domain of 144-NCB-030.0.411986.0.0.56082.9.2892939@envelope1.digikey.com designates 199.15.212.116 as permitted sender)
So digikey.com confirmed that the sender was authorized to send messages.  Sounds pretty legitimate to me.

[Fgrir]

I received it too and sending domain/IP, SPF, and DKIM are all valid and the same as the last marketing email I received from Digikey.  Maybe we all need to ask Oscar what happened?

[beanflying]

And this morning and not flagged as SPAM.

[KE5FX]

"The person responsible for sending the email apologizing for the earlier email has been sacked.  We apologize."

[AlfBaz]

Yeah I got one too although it was from "Oscar Wong"

edit more specifically "oscar.wong@e.digikey.com". Header reveals "envelope1.digikey.com [199.159212.116]"

[Bud]

Do they even have Digikey in China    Why ?

[ataradov]

I was surprised too. May be that was the point of the email. Just to let people know that this actually exists for no apparent reason.

[JohnnyMalaria]

Never in my buying from Digikey i ever got a 1 penny discount. Either this is BS or i am not an important customer 
And what the heck is "Full discount", though it may be a translation quirk.
[/quote]

What can I say? I have never ordered from Digikey but I got the email.

Then again, a couple of days ago, I ran a tracert against them because of a post elsewhere on EEVBlog.

[Bassman59]

"The person responsible for sending the email apologizing for the earlier email has been sacked.  We apologize."

The person responsible for sacking the person responsible for sending the apology has been sacked.

-- Signed, Richard Milhaus Nixon.

[tpowell1830]

Yeah I got one too although it was from "Oscar Wong"

edit more specifically "oscar.wong@e.digikey.com". Header reveals "envelope1.digikey.com [199.159212.116]"

Yes, this is the one I received today as well, Oscar Wong.

[jpanhalt]

There seems to be some debate about the legitimacy of the original email.  Digikey says it is legitimate:


In further correspondence with Digikey, I have the impression there is very little concern over the sharing of clients' personal information versus selling that information.  In other words, the customer service agent assured me the information was not "sold." Frankly, I don't care whether Digikey sells it per se.  What I am concerned about is the sharing with its "partners."  We all know a "partner" can be any entity that asks for it.

I consider my email and anything else related to me as my information.  Sharing with entities unknown to me is compromising it, so far as I am concerened.

[jpanhalt]

Do they even have Digikey in China    Why ?

My question too.  Buy high, sell low, and make a profit on the volume.

[GreggD]

30-ish years ago I got a discount on most things I got from Digikey.
Then the Digikey part numbers changed.
They added "-ND" to the end of the number.
And yes "-ND" means no discount.

True.

[S. Petrukhin]

It was necessary to dismiss Oscar Wong, but also the person who hired him and who is his manager, and who is engaged in security, and the general director, and in general close the DK completely. 

LCSC rules!