The only way to tell is if the ip address it goes to belongs to attws.

But sounds really fishy, don't do it!!

"Trey" <treydog90spam@hotmail.com> wrote in message

I got the same email and was immediately suspicious as well for the
following reasons:

1. an attachment called "Your_Secure_AT_T_Wireless_Statement.html"
2. having to enter your login/password

However, after further review, I believe that this attachment is
legitimate.

1. There was a link buried in the email:
To learn more about the eStatement, click here
https://www.attwireless.com/ocs/faq/FaqQandA.jhtml?view=faqlist&cat=2216&title=e
Statement
As you can see, the domain is under attwireless.com, which confirms
that this is a legitimate FAQ.

2. I saved the HTML (without opening) and opened in notepad. It looks
like an encrypted text file, with a javascript function to decrypt the
statement. Presumably, your username and password are stored as a hash
in the HTML file.

I strongly discourage everyone from using this "secure statement".
Even though this one may be legit, if you get in a habit of clicking
on attachments and entering your login/password, your self-defenses
will be lowered when someone else spoofs this statement. In fact, you
should not even have clicked on the HTML file to see what it was. Who
knows what kind of malicious javascript could have been unleashed?
When you get the statement reminder, just go to their website and log
in their as you had before.

This was extremely irresponsible of ATT Wireless to implement this,
because people will get used to this and get suckered for the next
spoof.