17th November 2004

Natwest

National Westminster Bank plc <users-support29@natwest.com>

0fficial Notice for all Natwest Bank users

HTML

Spoof email links to a spoof webpage where victim is prompted to enter their details believing the site is genuine. Details are then forwarded to a local script and captured.

Yes

http://208.13.140.172:87/n/

1. Email claims to be from Natwest asking you to verify/confirm your account. You will be taken to a spoof login page where your details will be captured by the phishers.

2. Natwest never send users emails requesting details in this way.

3. URL traced to a server in Orlando, USA.

4. This is yet another example of the 4903 scams and their variants. The same scam email has been circulating for over a year now. Easy to spot by the bad grammar, and the fact that the text of the email is all part of a single image - a technique used by scammers and phishers to bypass spam filters.