Halifax online banking attempted hacking

zeke

Has anyone else come across this recently? I logged into my Halifax online banking earlier this morning with usual username, password and memorable info (selected characters), all as normal, having arrived at the main screen with my various accounts it appeared greyed out with a popup box in front requiring all sorts of useful information including debit card number, expiry date, 3 digits on back, DOB etc etc. Right clicked and checked properties and it appeared to be a legit https address but obviously I didn't fill any of the information in and logged out of my account sharpish.

Just checked again on another PC and didn't get this and my account looks fine, no suspicious activities. Have virus-scanned the original Pc (with Avira), found something which it then quarantined, but a further login to Halifax still brings up this iffy popup.

Any ideas how to get rid of this please, or other useful advice?

Thanks.

opinions4u

Try installing and running the free version of Malware Bytes.

http://www.malwarebytes.org/products/malwarebytes_free/

MarmotSan

Try 'Trusteer Rapport'. Sorry cannot place links atm. Google it. Should be free to use.

They are used by HSBC and the likes. Your browser could be hijacked. Make sure your Anti-virus is up-to-date. When running Malwarebytes. Best boot into Windows safe mode.

agrinnall

Nothing to do with hacking, as o4u suggests it's probably malware on your PC. I wouldn't personally use Rapport, I would doubt the effectiveness of any software that has to be constantly forced on customers, if it was that good we'd be using it anyway.

Gromitt

You might have a http://en.wikipedia.org/wiki/Man-in-the-browser somewhere hiding in your PC. Don't make any transactions as they can be altered between your PC and bank (such as changing the destination account, amount, and so on). Might also be recording your screen and key board, so might be wise to change your login details.

Problem is, even if you get rid of the popup, there might be some other software still intercepting your banking. Only way to be sure when banking information is at risk is to reformat.

MarmotSan

agrinnall wrote: »

Nothing to do with hacking, as o4u suggests it's probably malware on your PC. I wouldn't personally use Rapport, I would doubt the effectiveness of any software that has to be constantly forced on customers, if it was that good we'd be using it anyway.

I personally would not use Rapport either on the grounds I don't enjoy having anything monitoring my network activities - all AV-suites do this with their anti-phishing modules.

It does however, have it's merits. It's designed for someone without much network security knowledge.

I've used it before with no problems and I've seen others who used it in the past and had certain legitimate network activities/programs blocked.

This software does advertise to work deep down, even blocking man-in-the-middle attacks, trojans, browser-hijack etc.

Here's a good tech-link

_ttps://krebsonsecurity.com/2010/04/a-closer-look-at-rapport-from-trusteer/

(replace the '_' with a 'h')

Jim431

As someone has already suggested it is probably a Man-in-the-browser type attack.

This has probably got into your browser. You don't say which browser you are using but you could try looking at the addins and plugins and try disabling anything suspicious.

However it would probably be better to go to the control panel and just uninstall the browser completely and download a fresh copy.

If you are using Internet Explorer then I would strongly advise you to move to another browser such as Firefox because their development community is far more pro-active in defeating attacks.

Since becoming aware of this type of attack I now have a portable version of Firefox in a read only folder that I use for any secure logins.
Also do regular spy-ware scans.

ChiefGrasscutter

Try posting in the techie sub-forum on MSE.
http://forums.moneysavingexpert.com/forumdisplay.php?f=29
The experts on that board will be of considerable assistance in cleaning up your computer of wahtever is in it.
In very bad cases of infection they sometimes recommend a total rebuild/factory restore of the computer.

dalesrider

Ring Halifax get them to suspend your internet banking till this is sorted and then totally reset ALL details.
PIA I know. But is the only sure way.

Goldiegirl

It does sound as if your browser has been hijacked.

Just over a year ago my old PC was on it's last legs and all sorts of viruses were getting in. Fortunately for me I was just about to get a new laptop.


I logged in to Paypal on the old PC, and got an overlay simlar to the one that you describe, asking for Social Security number, banking details and driving licence number.

The fact that I had logged into paypal made it seem genuine, but the thing that rang alarm bells was that they were asking for American details, e.g Social Security number rather than National Insurance number, and Routing Code (which they actually mis-spelt as routine code) instead of Sorting Code number.

Fortunately, my new laptop arrived, and when I logged into Paypal with that, there was no overlay. I changed my log in details, and had no further trouble.

If you are not able to sort this out your self I'd suggest getting professional help in, at least you'd know for sure that your finances were safe.

zeke

Thanks for all the advice to date. Haven't had much of a chance to sort the affected PC to dater but I have changed my login details on another PC, the account seems OK so far. I'll try malwarebytes next, see what comes up. Yes my browser is IE, never tried anything else to be honest.