Now I was suspicious, especially since there’s nothing but a login box at cdlounge.com (Strike #1 in my book). So I started digging around a bit.

BMG Music Service’s FAQ section states:

Q. How do I know an email is from BMG Music Service?
A. BMG Music Service will send you emails about your orders and account as well as special sales and promotions, and these emails will come from bmgmusic@bmgmusicservice.com. Occasionally you may receive a fraudulent email that appears to be from BMG Music Service but is actually an attempt to trick you into providing personal information that can be used for identity theft. These emails are often called spoof or phishing emails.

BMG Music Service will never ask you to confirm account information like passwords or credit card information through email. If you receive suspicious email, please forward it to us immediately at emailspoof@bmgdirect.com and we will investigate it.

The e-mail I received says it came from cs@bmgmusic.com, so that’s Strike #2 (it should be coming from bmgmusic@bmgmusicservice.com, according to the FAQ). I looked at the questionable e-mail’s headers, and its Return-Path is soneill@103637-litigation1.yourmusic.com—Strike #3 (Yourmusic.com looks as if it may be owned by BMG Music Service, but like CDLounge.com, it could just as easily be a competitor).

I tried to forward the e-mail to emailspoof@bmgdirect.com like they said, but it failed in a “this account does not exist” sort of way. So I’ve forwarded the thing to bmgmusic@bmgmusicdirect.com now, and I’m waiting to hear from them. If this isn’t an instance of phishing, the folks at BMG really need to get their act together. You just don’t tell people that you’re one site on the logo (BMGMusicService.com) but link it to another site (CDLounge.com) and have your e-mail originate from yet another site (YourMusic.com). So it’s either really fishy or really tacky.

UPDATE: Looks like it’s legit. See my recent update for more details.