Barclays Bank email Hoax and fake web page scam
26th October 2003 (also targeting Nat West, Halifax & Nationwide banks)

This Hoax Bank email was reported and in distribution on 26th & 27th October 2003 (see the latest Bank Email Scam). While these images show the Barclays Bank hoax, please be aware that customers of many different banks are being targetted with this hoax. These are just image snapshots of the originals, so there is absolutely no code included and none of the links or buttons will now work. The images shown here have been reduced to 80% of the original size unless otherwise stated

We had to ...
..... look at all references in this email to be sure that it was a hoax and a fake which aims to relieve Barclays Bank UK's website users of their membership numbers and passwords. This is sometimes referred to as Phishing or Spoofing, but it is in effect a hoax email scam (spoof email is an expression coined by eBay and Paypal, and an expression that we do not like too much since it is far too harmless sounding name for this kind of email scam (think of tv and film spoofs such as Hot Shots). We have also had reports involving the same email targeting other banks (including Nationwide, Nat West and Halifax). Halifax shut down their online banking facility for a

while on the 27th October due to the problem (users received a notification by email that they had done so). These hoax emails have been sent to many people that do not hold an account at whichever Bank it pretends to be from. If the scammers had focused on the right customers with the right email, the complaints may never have arisen at the early stage that they have.

The undescerning eye ...
..... will look over the very small anomolies in this email and many will fall for it and give out their Barclays UK website membership number and passwords. You need to have a keen eye to see the little bits that are wrong. The email contains a 'cloaked' link (even though a genuine barclays.co.uk web page address is involved in an attempt to convince you that this is genuine). This particular link is not as disguised as it could have been, so please read our section on disguised or cloaked links in Part 3 of our article on Online Identity Theft for more on how to recognise a link as being suspicious. In a this email though, you will notice the '@' sign in the link (usually this is concealed in hoax emails and represents a 'slip up' on the part of the scammers as it reveals its suspicious nature). This is the bit that tells the browser to do go to the address to the right of it (and to effectively ignore the part to the left of it) and this (in the image example below) is actually points to a Russian web site user's web space. That space is provided by mail333.com (Russia) but, this does not necessarily mean that the perpetrators are Russian (the web site has English language versions of their pages as well as Russian, and the service is free). Further reports from our site users has revealed that other web space providers are being utilised in this scam with the same pages (shown below) - so far there is another Russian web address (pisem.net) and an American one (cjb.net ). This suggests that this scam is going to be in distribution for some time to come.

The purpose of ...
..... sending you to that bit of Russian web space was to pick up a form (web form) and then send you to the genuine barclays.co.uk web site while presenting the web form in a small pop up window (which appears directly in front of the Barclays page as it is loading, making it look as if it really has something to do with the Barclays site). That pop-up window is titled 'E-mail Verification' and this is the scam - whatever you entered into those boxes in that pop-up window and submited via the 'Verify' button was sent to the mail333.com's users' mail box. There are other give aways to this hoax though .....

You may hear ...
..... much about the importance of email headers - well they are important, but also sometimes difficult for the average computer user to interpret or understand. As discussed in our article on Online Identity Theft involving hoax emails, almost an entire email header can be 'compiled' by the scammers to hide their true origin. It is possible, for instance, to send email messages through open SMTP servers (i.e. those that do not require user authentication to send email though them) and also to use an anonymous mail client and perhaps a couple of remailer services, by which time the true origin is completely gone and in no way available in the header data. However, when you DO find references that point outside of the apparent sender's domain or web space (as we have with this scam), you can safely believe the email to be a hoax. In this case (see images below), and from the data in the message header, the email travelled through the following mail servers to reach the recipient...

the email is sent from grungecafe.com's (in USA) mail server which passes through

a mail server at Club Internet (in France) and then on to

the recipients yahoo mail box

The Hoax Email...

The email seems harmless enough and even comes in plain text. The sender will be shown as "Verification" and the return email address is shown as " verify72@barclays.co.uk" which sounds okay doesn't it? Please note, that other sender addresses are in use, but they all contain "verify" with two numbers and "@barclays.co.uk". Remember, this scam is also professing to be from (and is targeting customers of) many banks including Halifax, Nationwide and Nat West, so the link will change in appearance. Now let's see the text of the email itself, especially since this is the part of the scam where the content remains much the same ( the link being the exception) in all reports so far .....

image is 100% of actual size

The web pages...

As discussed previously, the link actually takes you to somewhere other than barclay.co.uk. The page that it sends you to is coded to immediately redirect you to the genuine barclays.co.uk site, but also to pick up a mail form and present that in a small pop-up window in front of the genuine Barclays page .....

If you enter any information into this little form and press 'Verify', you send all that information (which they will no doubt attempt to use to your detriment.) to the scammer's mail box, while the pop-up window changes to a confirmation message (shown here at 100% actual size).....