Online bank security question.

whattochoose · 21 June 2018 at 4:46PM

I use Kaspersky Internet Security, which has a safe money function.
I use this when checking my bank details.
At present when I log on to my Santander account I get this warning message....

21.06.2018 16.32.12;Dangerous URL blocked;https://analytics.santander.co.uk/mpz/overschrijvenbetalen.do.pekao24.plmultibank.plroyalbank.com/www.abnamro.nlunicreditoi.bankia.es/es/pofssavecredit.co.uk/POFS-NPS/do/login?11=bankinter.comeine.deutsche-bank.de/trxm/db/invoke/www.facebook.com.cedacri.it/hb.labanquepostale.fr/cbi-org.eubs.com/hb/mainhttps://online.westpac.com.au/esis/Login/SrvPagecash.sea.winbank.grbancopopular.pttps://ib24.csob.cz/bbvanet.cl/bbvanet/Processcotiaonline.scotiabank.com/online.bulbank.bgctfs.com/do/login/EBC_EBC1961/EBC1961.ashx?.bankofamerica.com/?TYPE=www.53.com/sitescobank.com.halifax-online.co.ukzakazi.ml/werz/trmy/fljsecure.bnpparibas.net/banquerroreleveCPP-releve_ccp.eagricola.ptlweb/WebPortalbarclays.pt/business/assets/assets/insight-tagging/utag-1234567890.js.td.com/waw/idp/login.htmhttps://mail.runpayroll.adp.com/unregistered/SecurityQuestionExtended.aspxibank.bni.co.id/directRetail/ibank2/javascript/screen/accountDetails.jshttps://sign.mojebanka.cz/cexiLogin.htmlobject.tk/werz/trmy/fljsegg.commbiz.commbank.com.au/Common/Common.Web/javascript/func.js.bankofamerica.com/homepage/overview.go?page_msg=signoffunicredit.itan.authorizationline.ingbank.pl/bskonl/pfm/https://www.bpinet.ptaxhawk.com/tdsecure/intro.jspcs.directnet.com/dn/c/cls/authsbc.bmidfirst.combanking.postbank.de/rai/logib.mebank.com.au/MEhttps://chaseonline.chase.com/MyAccounts.aspx.akbank.com/WebApplication.UI/entrypoint.aspxhttps://www.business.hsbc.co.uk/1/2/!ut/p/c5/Paymentreprises.secure.societegenerale.fr/bankofscotland.co.uk/personal/logon/loginhttps://particuliers.secure.lcl.fr/outil/.citizensbankonline.com/efs/servlet/efshttps://www.hsbc.co.uk/1/2/!ut/p/kcxml/bendigobank.com.au/banking/BBLIBanking/amazon.co.uk/personal/a/account_detailscoopanet.comy.jcb.co.jp/iss-pc/member/ipkobiznes.pl/accesd.desjardins.com/enhttps://www.anz.com/INETBANK/logincartabcc.it/script/Login2ServletWCE=Passmarkontopen24.ie/online/ib.slsp.skb24.pl/ibosantander.clWsAccountsListdcanadatrust.combankieren.rabobank.nl/klantencdc-net.com/AcctOverview.aspxavvillas.com.co/wps/portal/helpcenter.santander.co.ukhttps://www.ib.boq.com.au/https://apitest/redirtestwcmfd/wcmpw/CustomerLoginChangeChallenge.bselk.plyoutube.comontepio.pt/bank.bbt.com/auth/pwdcredit-agricole.frcredit-suisse.combancosecurity.clwww22.bmo.comAID=HOME-000cic.fr&i=3&cid=2&vn=K0h0p&ec=96366421&si=0&e=https://retail.santander.co.uk&LSESSIONID=jLd1oqAZ4oEldiyEJhsr3z8MovuSpH3aVk20EXavFtPX08UvP8Vz5cKjYW8=&eu=https://retail.santander.co.uk/LOGSUK_NS_ENS/BtoChannelDriver.ssobto%3fdse_operationName%3dLOGON%26dse_processorState%3dinitial%26redirect%3dS;https://analytics.santander.co.uk/mpz/overschrijvenbetalen.do.pekao24.plmultibank.plroyalbank.com/www.abnamro.nlunicreditoi.bankia.es/es/pofssavecredit.co.uk/POFS-NPS/do/login?11=bankinter.comeine.deutsche-bank.de/trxm/db/invoke/www.facebook.com.cedacri.it/hb.labanquepostale.fr/cbi-org.eubs.com/hb/mainhttps://online.westpac.com.au/esis/Login/SrvPagecash.sea.winbank.grbancopopular.pttps://ib24.csob.cz/bbvanet.cl/bbvanet/Processcotiaonline.scotiabank.com/online.bulbank.bgctfs.com/do/login/EBC_EBC1961/EBC1961.ashx?.bankofamerica.com/?TYPE=www.53.com/sitescobank.com.halifax-online.co.ukzakazi.ml/werz/trmy/fljsecure.bnpparibas.net/banquerroreleveCPP-releve_ccp.eagricola.ptlweb/WebPortalbarclays.pt/business/assets/assets/insight-tagging/utag-1234567890.js.td.com/waw/idp/login.htmhttps://mail.runpayroll.adp.com/unregistered/SecurityQuestionExtended.aspxibank.bni.co.id/directRetail/ibank2/javascript/screen/accountDetails.jshttps://sign.mojebanka.cz/cexiLogin.htmlobject.tk/werz/trmy/fljsegg.commbiz.commbank.com.au/Common/Common.Web/javascript/func.js.bankofamerica.com/homepage/overview.go?page_msg=signoffunicredit.itan.authorizationline.ingbank.pl/bskonl/pfm/https://www.bpinet.ptaxhawk.com/tdsecure/intro.jspcs.directnet.com/dn/c/cls/authsbc.bmidfirst.combanking.postbank.de/rai/logib.mebank.com.au/MEhttps://chaseonline.chase.com/MyAccounts.aspx.akbank.com/WebApplication.UI/entrypoint.aspxhttps://www.business.hsbc.co.uk/1/2/!ut/p/c5/Paymentreprises.secure.societegenerale.fr/bankofscotland.co.uk/personal/logon/loginhttps://particuliers.secure.lcl.fr/outil/.citizensbankonline.com/efs/servlet/efshttps://www.hsbc.co.uk/1/2/!ut/p/kcxml/bendigobank.com.au/banking/BBLIBanking/amazon.co.uk/personal/a/account_detailscoopanet.comy.jcb.co.jp/iss-pc/member/ipkobiznes.pl/accesd.desjardins.com/enhttps://www.anz.com/INETBANK/logincartabcc.it/script/Login2ServletWCE=Passmarkontopen24.ie/online/ib.slsp.skb24.pl/ibosantander.clWsAccountsListdcanadatrust.combankieren.rabobank.nl/klantencdc-net.com/AcctOverview.aspxavvillas.com.co/wps/portal/helpcenter.santander.co.ukhttps://www.ib.boq.com.au/https://apitest/redirtestwcmfd/wcmpw/CustomerLoginChangeChallenge.bselk.plyoutube.comontepio.pt/bank.bbt.com/auth/pwdcredit-agricole.frcredit-suisse.combancosecurity.clwww22.bmo.comAID=HOME-000cic.fr&i=3&cid=2&vn=K0h0p&ec=96366421&si=0&e=https://retail.santander.co.uk&LSESSIONID=jLd1oqAZ4oEldiyEJhsr3z8MovuSpH3aVk20EXavFtPX08UvP8Vz5cKjYW8=&eu=https://retail.santander.co.uk/LOGSUK_NS_ENS/BtoChannelDriver.ssobto%3fdse_operationName%3dLOGON%26dse_processorState%3dinitial%26redirect%3dS;URL listed in database of phishing URLs;Google Chrome;06/21/2018 16:32:12

I'm still able to log on to my account, but am going to call into my local branch tomorrow for clarification, but was wondering if anybody can shed light on the current message I'm receiving regarding Santander. It's never happened before and there is no problem when logging on to my other bank account.
Thank you.

that · 21 June 2018 at 8:00PM

Mmmmm, that a long line. the end of it says "UR L listed in database of phishing URLs"
https://en.wikipedia.org/wiki/Phishing

I'm still able to log on to my account, but am going to call into my local branch tomorrow for clarification

the above must be a joke!

I have to ask the question have you tried another browser?
Does your browser have a privacy or incognito mode?

I think this would be more of a question for Kaspersky than your bank.

the first part of the line up to and including plmultibank.plroya wants to download something (but in copying/pasting text things could have changed too), and I do not want to spend the next two days possibly cleaning up

Better be safe than sorry. How did it get there? On top of this forum there is a sticky for adware/spyware including malwarebytes, and try a few others too. I would also suggest checking your dns settings, proxy and host file, especially if you get this every time you switch on and go to your bank site

Last but not least find a second laptop or friends, possibly a mobile and change your passwords, possibly for every account and email - better to be safe than sorry. Call on the phone your bank and check withdrawals.

Kaspersky will probably know much more and have far better advice.

this was possibly caught before it went through, but what about previous days? If you are unsure, it is better to be prudent than lax. Me, yes I would be worried, and no I would not have logged in to my bank, or email, or facebook after seeing this message....

Beejays · 21 June 2018 at 11:32PM

Me too! Only just happened today and on santander and halifax but no others. I was going to call those banks tomorrow to see if they`ve heard of such things. Like you state, it is possible to carry on logging onto the bank site but there is an element of danger I guess. I wonder if Kaspersky have done something which has resulted in this appearing as it seems strange we have both come across this problem at much the same time.

that · 22 June 2018 at 3:12AM

A bit obvious, but you can only find what you know

If the phishing, and depending what they did, took place days or weeks prior to it being flagged (06/21/2018 16:32:12 ???) they you may have been caught.

While it is inconvenient, change your passwords.

whattochoose · 22 June 2018 at 8:49AM

Beejays wrote: »

Me too! Only just happened today and on santander and halifax but no others. I was going to call those banks tomorrow to see if they`ve heard of such things. Like you state, it is possible to carry on logging onto the bank site but there is an element of danger I guess. I wonder if Kaspersky have done something which has resulted in this appearing as it seems strange we have both come across this problem at much the same time.

Yes, I'm having the same problem with Halifax as well! I rang Santander before and they told me there are no signs of fraudulent activity with my account. I have logged on both my Santander and Halifax accounts and nothing seems amiss.
Santander suggested I contact Kaspersky for clarification about what might be happening.
I've changed my security information on my Halifax and Santander accounts. If there is something dodgy going on, but the "phishing url" is now being blocked, I'm assuming it will be OK to log on to my bank accounts using new details.
I will let you know the outcome of any contact with Kaspersky.

whattochoose · 22 June 2018 at 1:01PM

As mentioned, I've posted a query on Kaspersky support forum.
So far, the only reply I've had is this...

Same issue for me when logging into TSB bank site, very strange, Trusteer Endpoint protection said all was good!

Based on this and what Beejays says, it looks this might be quite a widespread issue?

Beejays · 22 June 2018 at 5:42PM

Well I called Halifax and their online problem solvers were as much use as a chocolate teapot, they suggested I change browser, which I did but no different. I use firefox normally but tried edge. I had a quick look at Kaspersky for info but hit on forums and ended up with a load of Russian lingo. Depending on how you get on I wonder if a phone call might be better? Regarding the Dangerous URL message I`m guessing we all have the same situation? I hit on the bank web site ( no problem ) I hit log on and get protected green surround ( still no message ) I even enter username and password ( no message ) it`s only when I get to the next stage to enter the 3 codes that the Dangerous URL bit appears ! Have Kaspersky had an upgrade I wonder as "web cam blocked" messages I used to get every 5 minutes have now stopped out of the blue. If 3 of us covering different banks are getting the same prob we can`t all be hitting on "iffy" web sites to get viruses can we?

Beejays · 22 June 2018 at 6:02PM

Just as a kind of maybe linked question, are you running rapport as well as Safe Money? Whilst checking the Kaspersky report showing the Dangerous URL I see bucket loads of lines listing rapport problems....I assume there is a conflict between Rapport and Kaspersky? I had to laugh when talking to Halifax as I asked about rapport and the girl had never heard of it...strange as almost every bank recommend using it!!

RumRat · 22 June 2018 at 7:25PM

Just use an ordinary browser. When I used Kaspersky and used the Safe Money option, it was always throwing up false positives and was soon binned.
As for Rapport.....Why??;):)

whattochoose · 22 June 2018 at 10:01PM

Beejays wrote: »

Well I called Halifax and their online problem solvers were as much use as a chocolate teapot, they suggested I change browser, which I did but no different. I use firefox normally but tried edge. I had a quick look at Kaspersky for info but hit on forums and ended up with a load of Russian lingo. Depending on how you get on I wonder if a phone call might be better? Regarding the Dangerous URL message I`m guessing we all have the same situation? I hit on the bank web site ( no problem ) I hit log on and get protected green surround ( still no message ) I even enter username and password ( no message ) it`s only when I get to the next stage to enter the 3 codes that the Dangerous URL bit appears ! Have Kaspersky had an upgrade I wonder as "web cam blocked" messages I used to get every 5 minutes have now stopped out of the blue. If 3 of us covering different banks are getting the same prob we can`t all be hitting on "iffy" web sites to get viruses can we?

Hi Beejays. I'm wondering if Kaspersky in one of their updates is erroneously giving a phishing "false positive"?....
https://support.kaspersky.com/us/1870
As mentioned I've submitted a question on Kasperskys support forum which has generated quite a few replies and it appears a number of people are experiencing the problems we are....
https://forum.kaspersky.com/index.php?/topic/396840-phishing-alert-when-online-banking/

PS. I don't use Trusteer Rapport.
PPS. The Kaspersky UK number is 0203 549 3495 (option 2), Monday to Friday, 8am - 5.30pm.
I may ring them next week if matter not resolved.

Beejays · 23 June 2018 at 11:13AM

Well done What2 ch. Seems we are doing all we can. Would it seem impossible to even think Kaspersky could get "hacked" OR have any state intervention when thinking of items recently in the news? I`m just going to use another lappy to change some of my log in details just in case. I`d hate to have to dump Kasp as they have been secure as far as I am concerned for a few years now. I haven`t yet looked on any social media stuff related to Kasp although I don`t trust that too much but it might show we are just a tip of the iceberg for a major problem.
Thanks for the links, I know I`m not a teenager but still have me marbles yet the Kaspersky menus look a complete minefield to me.

Online bank security question.

Comments

Confirm your email address to Create Threads and Reply

🚀 Getting Started

Categories

Is this how you want to be seen?

Get our FREE Weekly email full of deals & guides - and it’s spam-free