With all the high profile breaches pretty much every one of us has received a breach notification email in the recent past.  But how many of you could tell if it was legitimate?

Take this email from Target from early in 2014. 

With all the Target Phishing  campaigns going around at the time many people questioned the legitimacy of this email.  At first glance it looks pretty legitimate.  

With all the garbage email we receive most of us have been diliigent that at a minimum we check two things: 

- links in the email point to where the link says it points and that where the link points looks legitimate, 

- sender address, and reply-to, address does not look spoofed

In this case there is only one link in the email and it  points to creditmonitoring.target.com, which is a page in the target.com website.   What made people question the legitimacy was the from email address.  It was sent from TargetNews@target.bfio.com.  Clearly not a Target domain.

It turns out this email is legitimate. bfi0.com is a part of Epsilon Interactive a marketing service that Target uses for customer marketing.  If you check Targets FAQ page it says:

-- Rick Wanner - rwanner at isc dot sans dot edu - http://namedeplume.blogspot.com/ - Twitter:namedeplume (Protected)