Phishing email

rolls99

Cheers all.

SnowTiger

teffers wrote: »

Look at the header details on the email. Seek out the source I.P rather than (an easy to spoof) named domain.

This is extremely poor advice to give.

Source IP address is easy to spoof within an email header.

Better advice is to ignore links within emails and go directly to the website.

Biggles

Oh, I got a gorgeous one this morning, with a new twist or two!

I just love them signing themselves 'Honestly, Barclays'!!! How do these eejits ever make a living? Or don't they?


Dear Barclays Bank Customer,

Due to concerns, for the safety and integrity of your online account we have issued this warning message.

It has come to our attention that your account details need to be updated due to inactive members,frauds and spoof reports.

To restore your account we have attached a form to this email, please download and complete the form.

After completing the form, within 24 hours you will be called by one of our operators to confirm the data sent.

Note: For security reasons we recommend you open the Internet Explorer browser.

If you choose to ignore our request, you risk your account being suspended indefinitely!

We apologize for any inconvenience this may have caused.

Honestly, Barclays Security Department.

We advise that you keep this email for future notifications. (E-mail ID: #47812)

iAMaLONDONER

Biggles wrote: »

Oh, I got a gorgeous one this morning, with a new twist or two!

I just love them signing themselves 'Honestly, Barclays'!!! How do these eejits ever make a living? Or don't they?


Dear Barclays Bank Customer,

Due to concerns, for the safety and integrity of your online account we have issued this warning message.

It has come to our attention that your account details need to be updated due to inactive members,frauds and spoof reports.

To restore your account we have attached a form to this email, please download and complete the form.

After completing the form, within 24 hours you will be called by one of our operators to confirm the data sent.

Note: For security reasons we recommend you open the Internet Explorer browser.

If you choose to ignore our request, you risk your account being suspended indefinitely!

We apologize for any inconvenience this may have caused.

Honestly, Barclays Security Department.

We advise that you keep this email for future notifications. (E-mail ID: #47812)

Hopefully action fraud will be able to catch them lol!

phona

Banks must realise that they shouldn't put links in their emails... It changes the message from "don't click links in emails ever" to "don't click links in emails unless they're from us". And how do we know they're from you? Oh you know my postcode?! That's a relief, because my postcode is a secret that I only share with the bank, of course.

Biggles, was the scam in the message you quoted one of those .pdf.exe attachments, or something else?
As well as the "honestly, Barclays" you pointed out, I enjoyed the threat "your account being suspended indefinitely!" with an exclamation, cos account suspension is hilarious!

teffers

SnowTiger wrote: »

This is extremely poor advice to give.

Source IP address is easy to spoof within an email header.

Better advice is to ignore links within emails and go directly to the website.

The advice, in an of itself, is not very poor.

The suggestion should not be regarded as a replacement of any other 'good practice' such as the option to go directly to the website. This should ALWAYS be done.

Source IPs are indeed spoofable but the information in the header would provide further indication of whether this was indeed a legitimate email, level of sophistication not-withstanding.

grumbler

teffers wrote: »

...the information in the header would provide further indication of whether this was indeed a legitimate email, ...

I think this information can only provide an indication that the email is not legitimate...

If it seems to be legitimate, this doesn't indicate anything.

rolls99

Well it gets more "interesting"


On the day I got the email, I forwarded it to NW's phishing email address.


I called NW, etc etc and as already said was cut off after half an hour.


I received an email today, from "firstname lastname" (a nationwide email address), saying I had a secure email.


In order to view it, I have to contact the sender (firstname lastname) - as they put a passphrase on the system (nationwide secure email, a bit like webmail and not the same as the messaging from within online banking).


You have to speak to them, as they will not email the passphrase.


I spent half an hour on the phone to NW today (after emailing the sender back asking for a method whereby I could contact them), to be told - A) The department in question does not take phone calls. Could not identify anyone by that name who worked there. C) It seemed "unusual" I should get a message in such a way anyway, what was it about?


I went through the story again, basically pointing out that I find it highly coincidental that the 'regular' email never arrived, to be 'replaced' by this other one, with links in it and so on, and was told that (in the last call) NW had had 'issues' with emails anyway.


I got the feeling that the call handler, while pleasant and so on, didn't really grasp the 'point' I was making, nor really seem to be able to explain, or, when asked, direct me to anyone who could, if indeed this is 'NW issues' or not.


My account is still fine, and I've logged in and sent a secure message to NW from within that so will wait and see what they say when they reply.


Regardless, "Spam", "Phishing", "Issues" or whatever, what concerns me is that no one can say "Yes or no" - NW "Praised" me saying I had done the correct things, but, their phishing address doesn't reply to you to say "We are aware of this" (or not) so in fact you don't know either way.


Not really an easy thing to communicate with them about.

SnowTiger

teffers wrote: »

The advice, in an of itself, is not very poor.

The suggestion should not be regarded as a replacement of any other 'good practice' such as the option to go directly to the website. This should ALWAYS be done.

Source IPs are indeed spoofable but the information in the header would provide further indication of whether this was indeed a legitimate email, level of sophistication not-withstanding.

Few people would know how to locate the information, let alone interpret it.

Email headers can easily be pre-loaded with seemingly legitimate details..

Biggles

phona wrote: »

Biggles, was the scam in the message you quoted one of those .pdf.exe attachments, or something else?
As well as the "honestly, Barclays" you pointed out, I enjoyed the threat "your account being suspended indefinitely!" with an exclamation, cos account suspension is hilarious!

It was an .html file, so could have contained anything.

I do like the advice to 'open the IE browser' 'for security reasons'. Most people recommend it's the last one you choose for security!