AAFES investigating ‘suspicious’ messages sent to military customers through email and store’s official app

The Army and Air Force Exchange Service (AAFES), a military retail organization that serves troops, veterans and their families, said it is investigating a string of suspicious messages sent to its customers through email and the store’s official app.

Customers began posting messages to social media Wednesday showing messages they received from an account purporting to be from AAFES. One email contained a link to a “wish list” being offered by the “AAFES Security Team.” 

A spokesperson for AAFES told DefenseScoop that it had notified all customers with an account at its online exchange store about the messages and posted warnings on social media, which acknowledged the “wishlist” link and said that other messages “may also be circulating.” Those suspicious messages also went over AAFES’s app, the spokesperson said.

“If shoppers receive an unexpected or suspicious email or push notification from the My Exchange app, please do not click any links, open attachments or provide personal, account or payment information in response,” Julie Mitchell, vice president for AAFES’s marketing customer engagement, told DefenseScoop on Thursday. “The message should be deleted.” 

When asked, Mitchell did not say where the messages originated from, telling DefenseScoop that AAFES was investigating the incident. She also said AAFES was still determining the impact of the messages and that its customer contact center saw a “small uptick” in calls.

AAFES, also called The Exchange, is the military’s largest retailer. It operates more than 5,500 facilities globally and serves an eligible customer base of about 30 million shoppers. 

The military has frequently warned about online scams where malicious cyber actors target service members, veterans and their families under the guise of a legitimate entity that is trying to collect information about the military community, steal its money, or both. 

Those scam attempts include fake job offers, identity theft, benefits poaching and other scams that take advantage of the often hectic lives of service members and families, their proximity to possibly sensitive military information and their regular income, said Ally Armeson, a former Army officer and executive director for the non-profit FightCybercrime.org, which runs a program to help troops and veterans protect themselves.

Armeson said “something is quite different about this” AAFES message in comparison to other types of scams she’s seen, citing its transmission through an official channel, the specificity of the target (AAFES customers) and the information a cyber actor would have to know before sending the correspondence, at least an email address of a customer tied to The Exchange.

Armeson said “all of this sort of points to there’s a breach somewhere or someone got in,” either through AAFES itself or a third-party partner. “I can’t say for sure, but this is certainly eyebrow-raising and concerning,” she added.

The Defense Department and Army did not answer DefenseScoop questions about whether AAFES experienced a security breach, and deferred questions to The Exchange. Mitchell did not directly answer the question, reiterating that the incident was under investigation.

Mitchell said that if personally identifiable information “is compromised, direct and timely notification to impacted customers is standard operating procedure.”

Spokespeople for the Air Force did not reply by publication. 

Typically, scammers use “spoofed” email addresses to disguise the sender as legitimate, often by changing a number or letter that the eye may not immediately catch. 

While AAFES said the message pushed through its app, DefenseScoop could not independently determine whether the retailer’s official email was used or if it was from a spoofed account. Mitchell said that too was under investigation. Social media users posted screenshots of the message showing a seemingly standard “no-reply” email address from The Exchange.

Despite AAFES initially posting that it was aware of suspicious messages being sent through text message, Mitchel told DefenseScoop that The Exchange had determined that only emails and app push notifications were affected. She urged customers with questions about the messages to contact AAFES customer support through the contact information on its website.