Issue 144 - December 2012 (1st Edition) - Page 4

Virgin Money 'Re-Confirm SiteKey' Phishing Scam

Outline
Email claiming to be from Virgin Money and styled as a Virgin Money Magazine claims that recipients must click a link to re-confirm their account SiteKey due to a recent database upgrade.

Brief Analysis
The message is not from Virgin Money. In fact, the email is a phishing scam designed to trick users into divulging their account login details to Internet criminals.

Enter your email address to subscribe to the Hoax-Slayer Newsletter:

Last updated: November 28, 2012
First published: November 28, 2012
Article written by Brett M. Christensen
About Brett Christensen and Hoax-Slayer

Example

Subject: Important E-mail Notification.

Re-Confirm Your SiteKey

Your SiteKey is a security measure that lets you know that you are at our authentic Online Banking site. Once created, your SiteKey will be displayed after you enter your user name when you log on to Online Banking. Do not enter your password without first seeing your SiteKey.

Your SiteKey includes both an image and an image title. You may select the current image displayed or choose a new image from the available selection.

Due to recent upgrade of our database. All bank account holder are requested to re-confirm his/her sitekey to enable our security database recognise your system and can be easily remembered.

Please click on the help centre link below to get started

[Link removed]

Regards
The Virgin Money Team

Virgin Money Phishing Scam

Detailed Analysis
This email, which claims to be from Virgin Money and is designed to emulate a page from the Virgin Money Magazine, informs recipients that they must re-confirm their SiteKey due to a recent database upgrade. Recipients are instructed to click a link to get started. The message comes complete with Virgin Money logos and formatting and associated images. Secondary links in the message open the genuine Virgin Money Magazine website.

However, the message is not from Virgin Money and the claim that account holders are required to re-confirm their SiteKey is untrue. The email is a phishing scam designed to trick recipients into divulging their account login details and other personal information to Internet criminals.

The link in the email opens a bogus Mobile Card Services login webpage that asks users to provide their username and password before clicking a "log In" button. Users are then taken to a second fake page that asks them to provide more personal information and provide the answers to the security questions attached to the account. All information provided can be collected by criminals and subsequently used to hijack real bank accounts and commit bank fraud and identity theft.

Phishing is a very common type of Internet scam and continues to gain new victims every day. Be wary of any email that claims that you must follow a link or open an attachment to upgrade account details. It is always safest to access any of your online account by typing the account address into your browser's address bar rather than by clicking a link in an email.

References
Phishing Scams - Anti-Phishing Information

Previous Article Next Article

Issue 144 Start Menu

Pages in this issue: