Zavvi Champions League Final Competition Winner Email Blunder

Like many Zavvi customers this morning, I received an email titled “Congratulations, you’re our Mastercard Competition WINNER!” in my inbox. An amazing prize consisting of two tickets to watch Liverpool and Spurs battle it out in the 2019 UEFA Champions League Final in Madrid. The prize also included two nights at a 4-star hotel, flights, transfers and a £250 prepaid card.

Zavvi Winners Email

Obviously, my initial thought it was a phishing email, decent quality and a well-timed attempt given Liverpool and Tottenham Hotspur were confirmed as finalists after very dramatic semi-final matches on the previous nights. I logged into my Zavvi account directly, then reset my password just in case, and after a bit checking with the embedded links within the email, and research on the Zavvi website, I soon established it was a genuine email from Zavvi.

But before embarking on a Mauricio Pochettino style injury-time winning goal celebration, I had a quick scan of my social media feeds, and it quickly became apparent there were many others believing and bragging they had also won this fantastic prize.

Image result for pochettino
Pochettino Celebrating an unbelievable Spurs Comeback in the Semi-Final

So unless the Athletico Madrid stadium has undergone a huge capacity upgrade, it became obvious that someone at Zavvi had made a huge blunder, resulting in personalised competition winner emails to be sent on mass to thousands of Zavvi customers.

UCL Final Ticket Allocation?

This kind of mass emailing replicates the time-tested phishing technique deployed by cybercriminals. But instead of having a malicious web link, a hidden malware-laced attachment, or the opening dialogue of a social engineering scam, it took its recipients on an emotional rollercoaster which ended with them feeling as flat as the Ajax players, after they lost their place in the final following an injury-time strike by Spurs’ Brazilian striker Lucas Moura.
Image result for ajax players heartbreak
Zavvi left their customers feeling as flat as Ajax players did last night


What compounded matters was Zavvi keeping relatively stum about the blunder throughout the day. The e-commerce entertainment retail store published an apology mid-morning on their Facebook page, but after 100s of comments by angry customers, they deleted the post a couple of hours later. It took them almost 8 hours before Zavvi finally followed up to the “Congratulations” email, by emailing an apology which offered a mere 15% discount off their website products. I suspect most Zavvi customer won’t be too happy about that, especially those that went through the day believing they had won a once in a lifetime competition.

Zavvi Apology Email – Sent almost 8 hours after the Winners Email


*** This is a Security Bloggers Network syndicated blog from IT Security Expert Blog authored by SecurityExpert. Read the original post at: http://feedproxy.google.com/~r/securityexpert/~3/AKWp3ScVdew/zavvi-champions-league-final.html