Scammers also need money at this time of year... :)

We all know about fake banking emailers that regularly get sent out, giving the impression that the mail is being sent from a legitimate financial institution.
We also know all about what to watch out for - I have written several posts on the topic in the past which you can search for if you need to find out more.

Anyway, I just received the latest FNB scam in my Inbox, and thought I would put some points out there about it:

- The mail supposedly comes from nolan.steven@fnb.cc.za - alarm bells should be ringing there already, since the sender domain specified is @fnb.cc.za (not @fnb.co.za);

- The mail did not go to Junk Mail, so somehow it got past my ISP filters and Outlook's Junk Mail filter;

- The body of the email is a bit dodgy (it's the first giveaway - oddly worded, no branding, plain text email...), and it goes like this:

         Debt. order ending 41405 from Old Mutual has deducted your monthly payment. 
         Click here to stop the order if you are not satisfied. 
         Regards

- If you click the link, you get to the page below, which actually looks pretty good if you aren't keeping up to date with the current FNB page. If you enter anything into the User ID and Password fields, it actually goes on to a One-Time PIN page, keeping up a pretty good illusion of legitimacy.:

The fake FNB site...

The fake OTP page...

- Rule of thumb: ALWAYS check the URL (web address at the top of the page) to see where you really ended up after clicking the link. Check this one out - it's the "smoking gun"...:

The fake URL...

Somehow I just don't buy "gledo.com"...
Once again, ALWAYS check the URL above the site. 

Sure, there are ways to mask URL's, but so far in all the scam mails I have received I have never come across a masked URL, so hopefully things remain this way...!

Be safe out there - even scammers need to eat, and they will send out anything remotely believable to try and prey on unsuspecting victims.

Related articles

• Scammers use email and letters to target kiwis
• Internet scammers target Instagram
• Nigerian scammer gets a laptop from me
• German E-Banking Users Fall Victim to Mobile Banker Trojan
• FastAgain PC Booster is a SCAM!

Read More

Can you be TOO secure when it comes to internet banking and viruses?

Of late, South African banks have stepped up their efforts to stop internet banking fraud, by introducing a number of 3rd-Party applications that are supposed to protect the end-user from potential threats.

The ones that I have encountered include Prevx (FNB) and Rapport (Nedbank), and they add an additional layer of protection onto your web browser, specifically targeted at protecting internet banking sessions.
End-users will happily install whatever the bank recommends, because in doing so, the end-user then has grounds to claim, should their account be hacked or breached in any way.
If an end-user has done everything that their bank has advised in order to stay safe online, then it minimizes any responsibility placed upon them, should the proverbial sh1t ever collide with the proverbial fan...

Now this is all fine and well, one might say. Anything in the name of security!
Then I inevitably get a call, and it goes something like this:

Caller: My PC is running really slowly lately...


Me: What has changed on your PC recently that may have caused it? Have you installed anything new? Changed anything?


Caller: Nope, just installed this banking software thing to protect me when I am online...


Me: Ah. Ok, and what other antivirus protection etc. is running?


Caller: ....dunno.


The call out that follows, invariably involves the discovery of one or more of the following software packages installed:

- Prevx
- Rapport
- Some antivirus (Avast, Norton's, BitDefender...)
- Windows Defender

The important thing to remember here is that each new antivirus / anti-spam / security package that gets installed on a PC, does 2 main things:


- It tries to protect you, and in doing so it scans opened files, web pages, RAM, folders on your hard drives, flash drives that you may plug in etc.
- In the process of trying to protect you, it uses system resources - i.e. RAM and CPU mainly.

Ultimately, trying to be as secure as possible on the internet is a delicate balancing act between safety and speed.
It is also not necessarily true that more is better - I have seen antivirus software identifying banking protection software as a virus... go figure...?!
So, in addition to speed concerns, you could end up with an arm-wrestling match between different software packages. It can become quite confusing!

As a guideline, I would say that one antivirus package, coupled to a single internet banking protection package should be sufficient.
If you happen to bank with different institutions who each want you to install THEIR preferred software, then you have a dilemma on your hands, because you are likely to end up with an antivirus package (assuming you already have one), and 2 or more packages aimed at protecting your online banking experience = potentially slow PC... :)

Related articles

• Dealing with Trojans (Not the Ancient Kind, Computer Ones) (brighthub.com)
• Be Safe: Choosing Your Spyware and Virus Protection (brighthub.com)
• Study Finds Microsoft's Free Antivirus As Effective As Symantec's Norton (blogs.forbes.com)
• Rview: Avast! Anti-virus (lehsys.com)
• We Answer: I am Using Avast and Ad-Aware. Do I need Norton? (brighthub.com)
• HSBC Ends Talks for Nedbank (online.wsj.com)

Read More

A new Standard Bank Internet Banking Scam is hitting inboxes...

I received a new scam in my inbox this morning - it targets Standard Bank customers and it goes something like this:

-----Original Message-----
From: Standard Bank [mailto:ibsa@standardbank.co.za]
Sent: 27 July 2010 03:17 AM
To: xxxxx@xxxxxxxxxxx.xxx
Subject: Standard Bank : Security Update Notification

 <http://www.standardbank.co.za/>
<http://www.standardbank.co.za/site/homepage/header.jpg>

Secure message received:

We request information from you for the following reason: Unauthorized
login attempt.

Please visit your account and make necessary steps before your account is
locked for security reasons.
 <http://www.treedesign.co.kr/zboard/icon/private_image/redirect.php>

If this is an unauthorised login attempt, we strongly advise that you
immediately log on to profile and change your password.
It is recommended that you regularly change your password and keep your
passwords unique from all other passwords.
Online Banking Team.


If you click on the embedded link (which is obviously dodgy), it brings up a slightly modded version of the Standard Bank site, complete with links back to the real Standard Bank site... so it all seems pretty real.

I then tried typing in some profanities into the login boxes, and lo and behold, I got this screen...:

So regardless of what you type into the login boxes, this screen pops up, to try and make you think that something is actually going on, while the only thing really happening is that your details have now been logged and captured, for use by some jellyfish somewhere on the planet. 

No offence intended to real sea-faring, stinging-type jellyfish of course...

Be careful out there, internet-goers and email-receivers.

Read More

New Nedbank scam mail - and this one is still very active so watch out...!

Re all my ramblings recently about ABSA scam mails being sent around, it seems that no bank is off limits here - just got this Nedbank one in my Inbox a few minutes ago.
I am not going to re-hash all of the many ways to tell if this is a fake mail, or how to avoid getting caught by these losers, but be aware that the link in this mail directs to an active site, which WILL capture your login details should you take the bait.

The mail looks like this (or similar):

Keep your guard up and be very aware of this kind of thing - it seems the scammers are on a mission to catch unsuspecting people out. Always double-check any electronic banking correspondence you receive!


...and once again, a message to the scammers - please guys, get a dictionary or take some English grammar classes! :)

Read More

Update on the latest ABSA scam mail...

Yup, you guessed it. I got another one in my inbox today.
I wonder if the scammers have been reading my blog, because they have changed their tactic slightly...

The latest mailer is identical to the previous one in appearance, except for one thing - the embedded hyperlink APPEARS to be legit - it appears as http://www.absa.co.za/absacoza/internet-banking/ within the mail.
So you may be thinking - well now that link goes to http://www.absa.co.za/ so it must be safe... Wrong wrong wrong!
You can use any line of text as a link - it's the code behind the text that directs you onto the internet.
So while the hyperlink appears to say http://www.absa.co.za/absacoza/internet-banking/, clicking it actually takes you to http://edunya.com/absa-ibanking/internet-banking-update/logonform.do/ibank-login.php - clearly dodgy.

As I said before, if you actually click the link, carefully watch where you are taken to in the address bar of your internet browser... until the scammers read this post at least... :)

Read More

ABSA is the spammers bank of choice!

So here we go again... re my last post about fake ABSA mailers going around, here is the latest rendition, fresh from my inbox this morning:

If you read my last post, I made some recommendations about how to pick up if a banking email is fake or not... let's put this one to the test:

- it seems the scammers / spammers are trying to get clever, since they have used online@absa.securenet.co.za as the "From" address.
The presence of "absa" in the address does little to convince me though, if you care to read on;

- the wording / language usage in this one is just a shocker. Scammers, if you are reading this, go out and take some evening classes in English before you send out your next broadcast please!
Let's dissect this...:

- "...we had a major server update without prior notice...". Sorry I don't buy that. Any banking institution who is a major player will give customers a decent heads-up before any major maintenance takes place on their systems.

- "...update some informations to continue using this service..." COME ON GUYS! Update some infomations? Seriously? Is "informations" even a word? Sheesh.

- "...we are dedicated to bring you the best possible service we can and this means keeping you safe..." WTF? Really? Does it mean that?

Guys and gals you get the gist of this - there are several ways to catch these dodgies out before they can cause any harm. Go through the list of common things to look for and you should be ok.

I will keep posting any new scam mailers that I get :)
They make for some funny reading!

Read More

ABSA scammers are at it again...

I just received this lovely email from ABSA THEMSELVES!! YES - THIS MAIL SAYS "ABSA" ON IT SO IT MUST BE FROM ABSA!!

Guys and gals, please don't get caught here - if you do in fact click on the link in the email, you will be taken to a fake ABSA site - what actually happens is that you are viewing the real ABSA site, but VIA another dodgy site.
Which basically exposes your authentication details when you login, and voila! You are broke.

Here is a screen grab of the dodgy email:

So to prevent getting caught out, here are a few guidelines to follow if you receive an email like this, and are unsure of what to do:

- first check the senders address. In this case it is card@onlineservice.co.za, which already sounds an alarm - no mention of ABSA anywhere;

- carefully check the wording of the email. As I mentioned previously in this post, the people who spend their miserable lives doing this kind of thing, usually have a poor grasp of the English language for some reason... While the english in this mail is not really bad, some small things in the wording can help us out - e.g. "We noticed some invalid login attempts..." sounds just a tad casual for a banking institution to use in an official email.
In addition, I would expect that any bank would rather contact customers telephonically, rather than send them an email about a security issue like this.

- if you actually end up clicking on any link in the email, take careful note of the website address that you are taken to (up in the address bar in your browser).
In this case, the link goes to:
http://www.savannahareajobs.com/include/dets/internet-banking-update/login.do/onlinelogin.php , which clearly has nothing to do with ABSA.
Rule of thumb - If it's ABSA, you would expect to go to something like http://www.absa.co.za/absacoza/ . If it's FNB, you would be looking for something like https://www.fnb.co.za/ and so forth for all the other banks.

When in doubt, keep a copy of the email for reference, and get hold of your branch or your account manager.
Better safe than sorry anyday.

Read More