MBNA officiaI notice! - Spoof Email Phishing Scam
23rd February 2004

Will the poor English and grammar give this phishing scam away to unsuspecting recipients with an MBNA account? Those with a less than suspicious eye for errors could well fall for this otherwise incredibly convincing scam!

read also our brief guide to Phishing

This spoof MBNA email is a forgery and what appears to be a text message with a link is actually an image that opens two web pages when you click on it (see image below).

Of the two pages opened, one is the genuine MBNA Europe home page and the other is a forged log in page. The log in page is made to look like a genuine pop up that is opened by the genuine MBNA page and has the tool, address and status bars removed, so you will not see the genuine URL. See snapshot of pages below.

This method of serving up fake content has been on the increase this week. We have been seeing this method used in recent Citibank scams, but are now seeing it used in other phishing scams as well. Since Microsoft finally plugged the URL Spoofing vulnerability in its Internet Explorer and Outlook products earlier this month, scammers are now turning to this method to fool their prey.

The actual URL of the forged MBNA web page is http://68.21.246.245:4903/m/...... and you would discover this by right clicking on the page and selecting properties.

We have also received reports of this scam which utilise different URLs ... http://202.134.165.178:2511/m/..... and http://68.21.29.228:2717/m/ ... we expect to see further changes. Had it not been for the poor english, we would have placed a HIGH RISK label to this scam.

If you have received this email, please remember that it is very common for these email scams to be redistributed at a later date with only slightly different content or the same but with the fake page(s) hosted by a different provider. Also, once you have received one of these hoaxes, it is also common place to receive at least another one and usually a day or two after the first, although not necessarily from the same apparent sender.

Take a good look at the following images, because this email scam may be coming to an inbox near you!

The Email ...

The Bogus Web Page ...