NatWest 'Customer Satisfaction Survey' Phishing Scam

Outline
Email purporting to be from UK bank NatWest, claims that the recipient has been selected to receive a 100 pound gift certificate as a reward for participating in a customer satisfaction survey. Recipients are invited to click a link to fill in a form and receive their reward.



Brief Analysis
The message is not from NatWest and the claim that the recipient has been selected for a 100 pound reward is a lie. The message is a phishing scam designed to trick recipients into divulging their Natwest login details to Internet criminals.

Last updated: October 8, 2012
First published: October 8, 2012
Article written by Brett M. Christensen
About Brett Christensen and Hoax-Slayer

Example

Detailed Analysis
This message, which purports to be from UK based bank NatWest, informs recipients that they have been selected to participate in a customer satisfaction survey that can earn them a gift certificate worth one hundred pounds. The message instructs recipients to click a link in order to fill in the survey form and claim their reward.

However, the message is not from NatWest nor has the recipient really been selected for any survey or prize. In fact, the message is a phishing scam that attempts to trick users into submitting their personal and financial data to online criminals. The message is just one incarnation in a long line of such survey scams that have targeted customers of various companies and financial institutions all around the world.

Typically, such scams work like this:

1. The victim clicks the link in the message as instructed.
2. A fake website opens and the victim is asked to supply the account username and password to login.
3. Next, the victim will be instructed to fill in a brief survey of four or five generic questions pertaining to the bank's service.
4. Finally, the victim will be asked to enter banking, credit card and other personal details, ostensibly so that the reward money can be sent to their account.

Both the login credentials and personal information supplied via the bogus website will be sent to the criminals running the phishing attack. The criminals can then use this stolen information to hijack the real accounts of their victims and commit credit card fraud and identity theft.

Be cautious of any message that claims that you can receive a substantial cash reward for participating in an insignificant survey. While companies may sometimes offer incentives such as a chance to win a prize to customers willing to participate in a survey, they are unlikely to offer customers large cash payouts just for filling out a four or five question survey. Moreover, no legitimate bank is likely to ask users to click a link or open an attachment to provide sensitive personal and financial information.

It is always a good idea to login to your online accounts by entering the account web address in your browser's address bar rather than by clicking an email link.





References
Phishing Scams - Anti-Phishing Information
Westpac 'Quick Survey' Phishing Scam
Coca Cola Survey Phishing Scam

Last updated: October 8, 2012
First published: October 8, 2012
Article written by Brett M. Christensen
About Brett Christensen and Hoax-Slayer