Another forged web form which is scripted to open as a pop-up style page in front of a genuine site page...

This spoofed email (see image below) purports to be from NatWest bank online and is in HTML format (although it does look like a text only email in order add a sense of authenticity to the link text). As in some previous examples (particularly Citibank Phishing Scams,) the fraudsters have coded their bogus web content to open the genuine site page in one browser window and the bogus web page in another pop-up style window in front of it, to give the appearance of a pop up that is related to the genuine page (see image below).

By viewing the properties of bogus web page (which contains a forged logon form) viewers will see that the the page actually resides at http://13579.info/..... which resolves to an individual in the USA and clearly has nothing to do with Nat West at all.

Any information submitted is processed through a script located on the same server as the bogus content.

If you have received this email, please remember that it is very common for these email scams to be redistributed at a later date with only slightly different content or the same but with the fake page(s) hosted by a different provider. Also, once you have received one of these hoaxes, it is also common place to receive at least another one and usually a day or two after the first, although not necessarily from the same apparent sender.

The Spoof Email ...

Dear Customer

This message is from NatWest, to inform you
that we had updated our anti-fraud system to prevent
frequent fraud attempts. At this moment we need you to
reactivate your account due to software security updates.
All accounts that haven't been reactivated will be placed
on hold.

To verify your account, please visit the NatWest
website at https://www.nwolb.com/secure/default.asp?refererident=96054329


We appreciate your business. It's truly our
pleasure to serve you.

NatWest Customer Care

This email is for notification only. To contact us,
please log into your account and send a Bank Mail.

The bogus web page (as you can see, the genuine Nat West page is opened as a back drop to the forged page)...