Barclays iBank - Please verify your e-mail address - Spoof Email Phishing Scam
29th February 2004

" Dear Barclays Internet Banking Customer! This email was sent by the Barclays IBank server to verify your e-mail address. You must complete this process by clicking on the link below and submiting Barclays secure verification form which appears in your browser "...

read also our brief guide to Phishing

This spoof Barclays iBank email (see image below) is in HTML format (although it is constructed to look like a text only email). It contains a link which you are urged to use to verify your email address, but the link is coded to appear to be a genuine Barclays iBank link. The link is also coded to show a fake URL in the status bar of an email program (while holding the cursor over the link).

The link is further coded to exploit the URL spoofing vulnerability that exists in unpatched versions of Internet Explorer. This bug allows the URL (in the browser address bar) to be spoofed - for instance, www.ibank.barclays.co.uk would be shown while a bogus Barclays iBank page, at a completely different URL, would be displayed in the browser window. Please ensure that you run Windows Update to patch your version of Internet Explorer.

If you are not sure if your browser is vulnerable to this exploit, we have set up a Browser Test. You can also check links in emails or web pages for cloaking using our Link Checker, and you can check for URL spoofing whilst at a web page using our URL Checker (which will also reveal the true origin of the web page that you are viewing).

The true URL of the bogus Barclays iBank web page is http://210.15.78.10/.......... which is registered to an individual in Zhejiang, China.

If you have received this email, please remember that it is very common for these email scams to be redistributed at a later date with only slightly different content or the same but with the fake page(s) hosted by a different provider. Also, once you have received one of these hoaxes, it is also common place to receive at least another one and usually a day or two after the first, although not necessarily from the same apparent sender.

The Email...

The first bogus web page...

(we have only included the first bogus page)