Sallie Mae Servicing: Phisher Mail?

[MatrixWatch]

Just received this one. Attached to the email is a PDF file which they have password protected. You have to enter your SS# to view the PDF. Is this a phisher mail? If so, then how could they harvest info like this from an adobe file?

You are receiving this email because of updates recently made to your
Sallie Mae student loan account.

The changes are viewable in the attached PDF document. The file is
password-protected and you will need to enter your Social Security
Number to open it.

Please keep in mind these personal safeguards:
- Save the document to your computer and disconnect from the Web before
opening it.
- Only use a personal computer to view the file - do not use a public
computer.

You will need Adobe Acrobat Reader to view the contents of the file. You
must have version 5.0 or later. A free copy of the reader is available
at www.adobe.com if you don't already have it installed on your
computer.

To view your account information, go to www.SallieMae.com and follow the
instructions on the homepage to enroll in Manage Your Loans (MYL),
Sallie Mae's online account management tool. It's quick and it's easy.
Once you've enrolled, you can use MYL to pay online, change your payment
plan, review your payment history, learn about repayment and
consolidation options, and more.

If you have questions about this email or the attached document, or you
are unable to access your account online, please call Sallie Mae today
at 888/2SALLIE (888/272-5543).

Thank you,
Sallie Mae


Full Header Info:


X-Apparently-To: < Edited out >
Thu, 03 Nov 2005 09:13:05 -0800
X-Originating-IP: [167.104.7.224]
Authentication-Results: mta186.mail.re2.yahoo.com
from=selfservice.salliemae.com; domainkeys=neutral (no sig)
Received: from 167.104.7.224 (EHLO sinetfi1.salliemae.com) (167.104.7.224)
by mta186.mail.re2.yahoo.com with SMTP; Thu, 03 Nov 2005 09:13:05 -0800
Received: from spcrlyfi20.usa-ed.net (connect1.salliemae.com [167.104.6.11])
by sinetfi1.salliemae.com (4.1/4.1) with ESMTP id jA3HD4M1005133
for < Edited out >; Thu, 3 Nov 2005 12:13:04 -0500
Received: from spcmadfi10.usa-ed.net (spcmadfi10.usa-ed.net [172.19.227.17])
by spcrlyfi20.usa-ed.net (4.1/4.1) with ESMTP id jA3HD4hJ006213
for << Edited out >; Thu, 3 Nov 2005 12:13:04 -0500
Received: from selfservice.salliemae.com (localhost) by spcmadfi10.usa-ed.net (LSMTP for Windows NT v1.1b) with SMTP id <7.000425CA@spcmadfi10.usa-ed.net>; Thu, 3 Nov 2005 12:10:05 -0500
Message-ID: <241382005114317105421@selfservice.salliemae.com>
X-EM-Version: 5, 0, 0, 4
X-EM-Registration: #0020551310301B00C100
Reply-To: helpdesk@selfservice.salliemae.com
From: "Sallie Mae Servicing" <dsn20051103I0005111@selfservice.salliemae.com>
To: < Edited out >
Subject: You Have Important Information From Sallie Mae
Date: Thu, 3 Nov 2005 12:10:05 -0500
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_01BC2B74.89D1CCC0"
X-NAS-Language: English
X-NAS-Bayes: #0: 2.42998E-223; #1: 1
X-NAS-Classification: 0
X-NAS-MessageID: 1670
X-NAS-Validation: {4C42D5BE-4C27-440A-B06D-CCDCA42C8976}

[mercinary]

Do you have any loans with Sallie Mae? I do, and I get these emails periodically. I believe they are completely legit. Note how the email doesn redirect you to any bogus site. Also note the tracking back to the originator (sinetfi1.salliemae.com)...it looks like a legit email from SallieMae.

-Merc

[MatrixWatch]

Looks like sallie mae isn't making any efforts to make the email look legitimate. I mean, at least direct me to a user account on their website or something.

[mercinary]

Actually, doing that (directing you to a user account) is exactly what companies are trying to move away from. When they do that, it opens up the door to phishers, because then someone can just replicate the email, but change the link to the user account.

-Merc