[Clarification: To my knowledge, www.mynewcard.com is a legitimate Bank of America website. -- DS, 2/5/2004]
Like many folks with their own domains, I usually use a different email address for each place that requests an email, so if I get spammed at an address, I know whose database was sold or compromised. So everyone make a big frowny face at the Microsoft Usability Group, as today I just received 20 identical spams (each with random subject headers) to the address I used with them a long, long time ago. I'm guessing it was a security breach and not a sale of their list, but either way, ick.
I also recently received what appeared to be a spam-like credit card offer from Bank of America (where I do have an account), at an address one character off from an address I use exclusively for Bank of America. Upon closer inspection, links in this email, including the "unsubscribe" link, go to "mynewcard.com". This domain is registered to "Douglas-Danielle" with an address in Chicago, and points to name servers at Qwest.net. The web site uses convincing, but suspiciously sparse, Bank of America logos and wording, and uses a secure form to prompt for your personal information, such as home address, account numbers, and Social Security Number. The unsubscribe form claims it will opt you out of phone and postal mail advertisements if you provide your complete contact info, and includes a blank for your SSN (which it says is "optional").
My first thought is that this is obviously a scam targetting Bank of America customers, where they appear to have managed to either crack into a B of A customer database (into which my address was entered incorrectly), or steal or salvage paper forms on which my info was written (which they then entered incorrectly into their own database). While I'm not convinced this isn't the case, douglas-danielle.com (registered with complete contact info), which is mentioned in the whois for mynewcard.com, claims to be a direct marketing firm. Their web site even includes a success story by "a leading credit card issuer." If Bank of America is actually employing Douglas-Danielle to solicit credit card applications through a non-Bank-of-America-registered website, they're making a serious mistake in judgement, and either way I hope nobody is entering data into that form.
While it's nice to hear that mynewcard.com is not a scam after all, I'd like to point out that the only way I could have known was via the tests I used, which failed. In general, nobody should be putting their personal information into a form served by an unfamiliar domain, especially via a link they receive by email. Bank of America is doing both their customers and themselves a disservice by collecting credit card applications through a third-party. At the very least, the URLs in that email-- including the "unsubscribe" form-- should all have been served from bankofamerica.com, and even then I would caution anyone who would listen to not trust links they receive in email. At best, no respectable bank should be soliciting credit card applications by email.
Furthermore, I saw no privacy policy stating that Douglas-Danielle wasn't retaining a copy of data collected via their web site.