Attempted internet bank details theft

Tim_L

Leads me to a standard rant about Egg, who are almost criminally irresponsible with their e-mail policy.

Egg offer an account consolidator which has been heavily promoted. So a lot of people have a lot of vulnerability through one account signup (sort of a case of putting all baskets in one Egg).

However they also send e-mails with relentlessly groovy notifications of statements "loud and proud, your new Egg statement has arrived". And they invite you to click through a link to access your account. There is no personalised data on the e-mail to allow you to verify the source.

It is, in short, a phishers dream. Very easy to clone these e-mails with a fake link, and potential access to a very large number of accounts in one hit if someone does fall for it.

But if you write to Egg to explain this and to complain, you get a pompous and stuffy e-mail back explaining that they have very high security standards. If you press the point they get very shirty indeed.

This is lethally dangerous, and they are very complacent about it: can I urge anyone with an Egg account to get in touch and tell them it is not an acceptable way to proceed in an age of identity fraud?

-=Mr-J=-

The easiest way to avoid this is not to click any link contained in an eMail, use the eMail as an for information only source.

Access your bank account details by opening your browser and typing the URL into the address bar.

Remember, there are many attacks that are concerned with replacing your existing bookmarks with bogus target URLs. They may look the same but they may not be, especially if the now valid international character URLs are used.

irnbru_2

-=Mr-J=- wrote:

Access your bank account details by opening your browser and typing the URL into the address bar.

... assuming of course your domian resolution isn't compromised.

irnbru_2

moneysavingobsessive wrote:

How do the scammers know who I bank with?!!

As gromituk pointed out, they don't. However, you or someone else whom you've emailed has been less than diligent with their system and your email address.

Always try to use email addresses which contain something about the recipient. Thus, if it's comprised you can clearly see who was negligent.

-=Mr-J=-

irnbru wrote:

... assuming of course your domian resolution isn't compromised.

LOL, yes, its never easy is it.

Anyone into remembering IP addresses?