Issue 131 - May 2012 (2nd Edition) - Page 16
Santander Online Banking Software Upgrade Phishing Scam
Email, purporting to be from large banking group Santander, claims that, due to a scheduled security software upgrade, the recipient must click a link to upgrade their account immediately.
The email is not from Santander. In fact, the message is a phishing scam designed to steal login and banking details from Santander customers.
Detailed analysis and references below example.
Last updated: 30th April 2012
First published: 30th April 2012
Article written by Brett M. Christensen
About Brett Christensen and Hoax-Slayer
Subject: Santander Online Banking Notice
Dear Valued Customer,
Santander Online Banking technical services department
is carrying out a scheduled software upgrade to improve
the quality of services for the bank's customers.
Please upgrade immediately by clicking on this link below:
Secure Sign-In Access
Thank you for your prompt attention to this matter.
This bogus message falsely claims to be from the security department of large banking group Santander. In a tried and tested phishing technique, the criminals responsible for this scam attempt claim that recipients must immediately click a link to update their banking details due to a scheduled software upgrade. Supposedly, this software upgrade will result in improved services for customers.
But, of course, the message is certainly not from Santander and the claim that the recipient must upgrade his or her account is untrue. The supposed account upgrade requirement is simply the bait used to trick victims into visiting a fake "Santander Online Bank" website and submitting their personal information. The fake site has been made to look very similar to the genuine Santander website. Those who fall for the trick and click the "upgrade" link will first be taken to a bogus bank login page as depicted in the following screenshot:
Next, the victim is taken to a second fake page that asks for the account passcode, pin and contact details:
After submitting the requested information, the victim is taken to a third fake page that asks for the security verification questions attached to the account:
Finally, the victim receives a pop-up message advising that the verification request has been successfully completed:
After clicking the "OK" button, the victim is then automatically redirected to the UK branch of the genuine Santander website. Meanwhile, the criminals behind the scam will be able to collect all of the submitted information and use it to hijack their victim's real Santander account and commit fraud and identity theft.
130advises its customers about such scams
via its website. As with other legitimate banks and financial institutions, Santander will never ask customers to provide online bank details via an email.
Common Threats - Phishing
Phishing Scams - Anti-Phishing Information
Pages in this issue:
- Paypal 'We Need Your Help Resolving an Issue With Your Account' Phishing Scam
- Boy Shot By Step Dad Charity Hoax
- One Direction Facebook Page Hacker Warning Message
- Windows Live 'Account Blocked' Phishing Scam
- 'Quilts in the Snow Photographs' - The Art of Simon Beck
- Shark Behind Scuba Divers Photo Hoax
- Facebook Survey Scam - Free Oakleys To All Facebook Users!
- Gang Initiation Warning Hoax - Infant Car Seat Left On Roadside
- Do Not Call - Mobile Phones Going Public Hoax
- Amazon 'Order Cancellation' Pharmacy Spam Emails
- Commonwealth Bank Phishing Scam - Online Access Suspended Message
- Circus Cruelty to Animals Protest Message - Baby Elephant Photograph
- Survey Scam - Free $1000 Walmart Gift Card Text Message
- Pharmacy Spam Emails Purport to be From YouTube
- Hoax - Picture of 'World's Largest Tortoise'
- Santander Online Banking Software Upgrade Phishing Scam
- Apple Store Account Phishing Scam
- Legitimate: 'Reminder to Update Your Legacy Blogger Account' Email