Alert - NatWest Phishing scam!

[Geaney]

In case any of you chaps are users of NatWest online banking...

I just got an email telling me that certain account transactions have been revoked and I should login to validate them and restore access. The email is fully branded like the NW website. The mail includes a logon link which takes you to a website that is an exact duplicate of the NW page. The url however is registered in Peru and does not contain the NatWest name anywhere.

I'd say if you fill in this bogus logon form you are giving the bad guys full access to your account(s).

Forewarned, etc.

Cheers,

John

[Refugee]

I sometimes go to the official website for the bank through the URL they have given to me and use there report button and quote the text from the message origin screen in the email reader.

[camallison]

Forward the email to phishing@natwest.com and that gives them the opportunity of digging into the headers in the email and understanding what they are up against.

One of my PCs (deliberately left unguarded as a "honeypot") receives all sorts of similar emails from banks I have no affiliation with. They just hope to catch out the odd one who is unwary.

Colin

[AlanBeckett]

Haven't had one for a couple of years but they used to be regular.
As Colin says pass it on and they'll sort it.

Alan

[Skywave]

One of my PCs (deliberately left unguarded as a "honeypot") receives all sorts of similar e-mails . . . . . .
Colin

Hmm . . . I like it! There are certain Government Agencies that could use your skills.

Al.

[camallison]

One of my PCs (deliberately left unguarded as a "honeypot") receives all sorts of similar e-mails . . . . . .
Colin

Hmm . . . I like it! There are certain Government Agencies that could use your skills.

Al.

A long way back, I owned an Internet security company and still remain in contact with the present owners. We each operate a "honeypot" and aggregate findings with similar-minded people/firms. The machine is a relatively unpatched XP-based PC sitting there occasionally sending emails and surfing randomly. The contact list it has on its mail client has all the other "honeypots" so we can see when/if it becomes compromised.

All the security companies run these at various locations to perform the same function..

I must admit though that my programming skills have taken a knock over time, and I couldn't run such a business any more.

Colin

[Old Sparky]

My policy with such e-mails is to delete them without opening them. Should I get one purporting to be from an organization with whom I deal, I forward it to their fraud detection department and then delete it. As John rightly says, these e-mails are designed to trap the unwary and, under no circumstances should they be replied to, nor any links contained in them opened.

[Refugee]

I don't even like forwarding them. If I do anything more than delete instantly I copy and paste the headers to the banks security department.

[Nick]

These things are two-a-penny - they've been around for years and there are 100s if not 1000s of variations - the bottom line is NEVER EVER click on a link to take you to a "secure" site - always go there directly.

If in doubt about any email that might be a scam, you can usually check them, or the story behind them, at http://snopes.com - a very useful site...

There are ways even a direct URL can be compromised (e.g. primary DNS redirection or "hosts" file tampering), but its very rare and if your PC is protected with decent, up-to-date, anti-virus and patched regularly, you should be fine if you explicitly enter URLs.

I don't even like forwarding them. If I do anything more than delete instantly I copy and paste the headers to the banks security department

No disrespect, but pretty much a waste of time - they'll see 100s or even 1000s of each of these from their own honeypots (its a standard thing to do) before they get yours, even if they bother reading it.

I don't run a personal honeypot, but I have them on our internal networks to detect anything roaming inside the firewalls.

The NSA use them too, except theirs are REALLY cunning - they bite back in extremely subtle ways including zero-day exploits. Do a Google on "Tailored Access Operations" if you want to see just how clever they can be...

TAO servers "harvest approximately two petabytes of data per hour" according to "internal sources"...

[Skywave]

One of my PCs (deliberately left unguarded as a "honeypot") receives all sorts of similar e-mails . . . . . .
Colin

Hmm . . . I like it! There are certain Government Agencies that could use your skills.
Al.

A long way back, I owned an Internet security company and still remain in contact with the present owners. We each operated a 'honeypot' and aggregated findings with similar-minded people/firms.
Colin

Ah! That explains things. It just seemed unusual for the 'ordinary PC user' to do what you do. I must admit, I was intrigued.
Thanks for the clarification.

Al.