Bank Systems & Technology is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


07:12 PM
Connect Directly

New Phishing Tactic Dangles Millions As Bait

Phishers twisted a long-standing scam tactic into their newest technique to fake consumers out of their bank account information -- and the money in those accounts.

Phishers twisted a long-standing scam tactic into their newest technique to fake consumers out of their bank account information -- and the money in those accounts -- a security firm said Friday.

The new scheme starts with an e-mail from a phony bank, claiming that a large amount of money has been placed into a new account opened in the recipient's name. A link to the bogus bank is included, along with an account number and a PIN.

The message goes on to say that the recipient can transfer the money by logging into this account -- which shows a large balance -- and then by providing information about a real bank account to finalize the transfer.

"In some ways, this is similar to the Nigerian 419 scam," said Dan Hubbard, the senior director of security at San Diego-based Websense. "It has some similar characteristics."

In the long-running Nigerian scam, also called the "advanced fee fraud," vast sums are promised in return for either up-front good faith cash or access to the victim's bank account to make the fund transfer.

"We've seen phishers use fake banks before," said Hubbard, "but this is the first time we've seen a scam that says money is waiting to be picked up."

In the example e-mail that Websense captured, the text begins, "We have been directed by the Mega Magic Foundation of France to notify you that the sum of One Million Euros has been deposited in our bank, DBS Bank, in your name, awaiting immediate transfer to your personal bank account."

The message concludes with the kicker: "Once logged in to your account, you can transfer via wire directly to your personal bank account by clicking on the 'click here to transfer' link."

The logo displayed in the message is fake, said Hubbard, but there is a holding company that goes by the name of DBS Bank. However, he didn't know whether the name used by the scam was simply a coincidence or planned. He suspected the former.

"More and more fraudulent-based sites are appearing that don't target a specific brand," said Hubbard in explaining why this tactic doesn't use a real-world institution, as do many other phishing attacks. "Since the bank is probably fake, the phishers don't have to worry about any countermeasures. Who would someone report this to? There's no brand directly affected."

Most phishing attacks aim at a specific bank, such as Citibank or Washington Mutual, and are first discovered when customers report the scam to their bank.

"This is another example of the continued creativity of these people," said Hubbard.

Register for Bank Systems & Technology Newsletters
Bank Systems & Technology Radio
Archived Audio Interviews
Join Bank Systems & Technology Associate Editor Bryan Yurcan, and guests Karen Massey and Jerry Silva from IDC Financial Insights, for a conversation about the firm's 11th annual FinTech rankings.