‘BP Fuel Card e-Bill’ Excel Macro Malware Email

BP Fuel Card Macro Malware


This email purports to be from a fuel card provider and claims to contain an e-bill for a BP fuel card in an attached Microsoft Excel file.

However, the email is certainly not from any legitimate fuel card services company and the attachment does not contain a fuel bill. If you do open the attachment, you will be prompted to enable macros, ostensibly so that the ‘bill’ can be correctly displayed.

But, alas, once macros are enabled, a malicious macro can run.  The macro can download and install various other kinds of malware. Once installed, this malware can steal sensitive information such as passwords and allow criminals to access and control the infected computer.

If you receive one of these emails, do not open any attachments or click any links that it contains. And, unless you have a specific reason for using macros, it is best to leave them disabled in Microsoft Office.

If you are unfamiliar with macros and their potential dangers,  please refer to this other Hoax-Slayer article, which provides more information about the topic.


Subject: BP Fuel Card E-bill 0200442 for Account B216552 31/01/2016

Please note that this message was sent from an unmonitored mailbox which
is unable to accept replies. If you reply to this e-mail your request
will not be actioned. If you require copy invoices, copy statements,
card ordering or card stopping please e-mail [removed] quoting your account number which can be
found in the e-mail below. If your query is sales related please e-mail


Subject: BP Fuel Card E-bill 0200442 for Account B216552 31/01/2016

Account: B216552

Please find your e-bill 0200442 for 31/01/2016 attached.

To manage you account online please click

If you would like to order more fuel cards please click

If you have any queries, please do not hesitate to contact us.


Cards Admin.
[Name of fuel card provider removed]

Supplied according to our terms and conditions. (see

Email includes an attached file called: ‘ebill0200442.xls’

Last Updated: February 5, 2016
First published: February 5, 2016
By Brett M. Christensen
About Hoax-Slayer

Macro Virus Threat Returns – Beware Emails With Malicious Word Attachments