New Phishing Scheme Targets Abbey E-Mortgage Clients

One of the most counterfeit bank identities in the world,
Abbey, which ranked the eighth in our latest E-Threats
Landscape Report, got again the phishers’ attention.

The unsolicited message sent on behalf of Abbey Anti-Fraud
Team warns the bank customers about the alteration of their accounts. Hence, it
asks them to update the compromised information by accessing the page provided
in a hyperlink.

The link does not lead to the on-line bank portal, but to a
Web page that employs several visual identification components of the original
Web site, namely the bank logo and the general formatting elements.

Few details: even though all menu options are available,
clicking any of them will return a “404 Page Not Found” message. Moreover, one
can easily see that the Web page address mimicking the genuine Web site loads from
a different domain (.net instead of .co.uk).

Also, there are no specific security elements, one could
expect to find on an e-banking site, namely SSL encryption (Secure Socket
Layer) and security authentication methods (no “https” prefix and locked padlock).

The analysis of source code revealed that the sensitive data
are stolen using a single PHP script (loginphish.php), that records and sends
to a remote database the card number or personal ID, passcode and registration
number.