We’ve all had various emails from many different banks, all claiming that there has been an error with your bank account and that you need to click the embedded link to fix the issue. While a lot of people already know how to spot these dangerous emails, there are some that don’t have a clue about them and the damage they could cause. This is just a small blog post where I’ll try to help people understand how to spot the clues that are found on the emails and web links.
Ok, this part is showing the clues within the email itself:
- The addressee: In a genuine email from your bank; they will always address you by your name, not your email address or as “Dear user/customer”.
- The sent email address: This can be a bit of a tricky one to recognise. A lot of fake emails will have an email address that is close to the real address, sometimes it can even be just a difference in the .com/.co.uk domain part, because of this don’t follow this rule as absolute, this is just a little clue.
- Spelling errors: You won’t find this too often but sometimes, you will notice that there are a few spelling errors in the email, this would very rarely-if at all-happen in genuine emails.
Note: This is another clue but not as solid as the others. Notice how in the email, they tell you to click the link below to access the web page, well in genuine emails; they’ll rarely put any link in the email and just simply ask you to “Log in to the bank through your browser”
Now that we’ve covered the email part of the scam, let’s click the embedded link and take a look at the web page.
The first thing you’ll notice upon loading the website is that they almost always look identical to the genuine website – aesthetically that is.
- The login boxes: These are usually the only part of the web page that will actually do anything.
- The URL: More times than not, the URL for the web page will be pretty indistinguishable, they usually have a completely different URL the what the web page should be.
- Page elements: This is just an extension to point number one. Try as you might, nothing on the web page does anything, almost always, they’re just images captured from the genuine page. Even the “Remember me” check box doesn’t do anything.
For this part, I’ve entered in some fake details into the login boxes so I can show you the next part of the scam page.
- The URL: Notice how the URL for the page has changed, this is again one of the biggest giveaway’s to the phony web page.
- Personal information: Here, it’s asking for personal information like the “Memorable word” and “Mother’s maiden name”. With the info that would be provided in these boxes, the scammers could call up your bank and almost certainly gain full access to account details and transaction utilities. They ask for the memorable word and your mother’s maiden name because these are the most common options that you would likely use, like using the same password for every website that you have an account with.
- Bank details: This is where the scam gets dangerous. Any information you place in these boxes is sent directly to the scammers. Remember: No bank will ever request this information from you, perhaps with the exception of your account number. The details entered in these boxes could completely open your bank account to these scammers. They could completely empty your bank and lock you out at the same time, and once that information has been sent, there’s very little you can do to rectify it.
Again, I’ve entered in phony details so I can show this final part. No matter what you do, this will typically be the next screen you see. Every detail could be perfectly correct and yet the dialogue saying “Memorable information is not correct” will show up. This is just to make the web page look that little bit more genuine, if they were to put a splash page up saying “Well done, we’ve just gained complete access to your bank and we’re now emptying it”; then you could still have enough time to call the bank and lock your account. With this splash, it deceives the user into thinking they’ve made a mistake and could sit there for half an hour double checking and triple checking that their info is correct before calling the bank to seek help only to find out that the account has been emptied of life-long savings and your child’s college fund.
Well, I think that’s just about everything I have to show you about the giveaway clues to a phony bank web page. Most of this article will also apply to other financial websites like: PayPal, Payoneer, eBay etc. I really hope you find this article helpful. There are so many people out there that are completely oblivious to this kind of cyber attack. If you find this article helpful in any way, please share the link and spread the word so people don’t fall for this crime.
Also, if you have any other tips on how to spot a phony email, please share with us in the comments below, tell us your tips and experiences if you’ve fallen victim to these dangerous crimes.
We’ve all shopped on eBay at least once, even if you haven’t bought anything, you’ve at least checked out the website. Am I right?
Just Another Tech Blog. 