Abbey | Account Notification: Access To Your Account Has Been Limited

After NatWest (currently 67 posts), Abbey is the second placed banking target on this site, with just 17 posts. It's trying to catch up...

This at least gives a reason for the verification, but from experience I know that when the account is restricted the restrictions are lifted only by posting new cards out - I know, I had to wait without access to my cash until the new card came through!

The actual target URL is http://www.rightleadership.com//poll/pollphp/verify/cgi.htm, which seems to be a perfectly innocent site. I've not tested that the link does work, but I expect that somehow the phishers have broken into the site.

Unauthorized Access Notification

Dear Abbey Bank Customer,

This message has been sent to you from Abbey Bank because we have noticed invalid login attempts into your account, due to this we are temporarily limiting and restricting your account access until we confirm your identity.

We therefore implore you to log into your account to verify any possible findings.

VERIFY

Thank you

Important Information about your Current Account

This one is a different format to usual. Not only does it look different (and was received through 2 email addreses...) but it's making out that the verification process for regular maintenance is random and because of potential fraudulent use. What??? It seems to be throw out a few different reasons to fill the email and just hope the victim clicks the link.

The link actually points to http://myonlineaccounts2.abbeynational.co.uk.koro.biz/CentralLogonWeb/Logon?action=prepare , which they also provide as a visible URL in case it can't be clicked on. Very handy of them! No idea what koro.biz is, but it'sstarting to appear in other phishing results.

Here's the content:

Dear Abbey National customer,

WE ARE CURRENTLY PERFORMING A REGULAR MAINTENANCE OF OUR DATABASE FOR ONLINE CUSTOMERS.

We apologize for the inconvenience this may cause but your account was randomly flagged for verification and you'll be taken through a short authentication process.

To start now please click here.

If your e-mail client stops you to click the link above, please copy the following URL to your browser:

http://myonlineaccounts2.abbeynational.co.uk.koro.biz/CentralLogonWeb/Logon?action=prepare

Please note! If we don't receive the appropriate account verification within 24 hours since you've got this email your online access can be suspended until further notice. The purpose of this verification is to ensure your account has not been fraudulently used and you're not a victim of identity theft.

Thank you for understanding and helping us improve.

------------------------------------------------------------

Unauthorized account access or use is not permitted and may constitute a crime punishable by law.

© Abbey National. 2001 - 2008. UK.

Official Notification For Customer of Abbey OnLine Banking

Even on a UK Bank Holiday there's no let up in the phishing emails. This one is very similarto an Abbey Phishing Email oflast November - the first one in which I saw the 'If you are not a customer' line.

There's a few changes - Support Department instead of Technical Department, following has become visiting etc, but essentially it's the same email. With this one the link actually points to http://ww5.an-business.com.direct52.in/servlet/?pid=[removed] - although I can't find direct52.in in any search results. It's obviously a fake - don't try the link.

Dear Abbey Internet Banking user!

Our Support Department is running a scheduled OnLine Banking software upgrade

By visiting the link below you will open the procedure of the customer details confirmation:

http://www5.abbeynational.co.uk/servlet/?taskid=24yzrpeFDozrcrkdwvrnOkhOvp

These instructions are to be e-mailed and followed by all clients of the Abbey National Bank On-line Banking

Abbey National Bank does apologize for any inconveniences caused, and is very grateful for your help.

If you are not client of Abbey Personal and Commercial please disregard this letter!

*** This is automatically generated email please do not respond ***

(C) 2008 Abbey National Bank Bankline Internet Banking. All Rights Reserved.

Abbey National | Online Banking - You Have 1 Unread Message

It's been a little quiet recently - no posts for a few days. Not the usual weekend rush - maybe the phishers are waiting to take advantage of the coming long weekend. But the Abbey National 'You Have 1 Unread Message'has reared it's head for the first time since January

Looks to be exactly the same as then - look at the image on the link above if you want to view a graphical copy. This time the destination url is http://www.abbeynationalsecurity.com/myonlineaccounts2.abbeynational.co.uk/CentralLogonWeb/Logon_action/secure.php - a very convincing URL and found in many other phishing search results.

Don't touch the links - just ignore the email. Here's the content:

Dear Valued Customer,

You have a new message waiting in your Inbox Folder.

Click here to read.


Best Regards.

The Abbey National plc Security Department Team.

* Please do not reply to this email as your reply will not be received.

Abbey | REF# 2121 Important Information Regarding Your Account

This one is very similar to the previous report. As far as I can tell, it's just the number in the title that's changed.

The destination remains the same at http://211.202.2.46/~sehwa/db/q1.php?klsud=[email removed], so maybe the number in the title references the email address targetted in some way, as the two emails were received through different boxes. For reference, this Natwest and this Nationwide emails are identical.

Here's the content again,

Dear [email removed]
,
We recently reviewed your account, and we suspect an unauthorized ATM based transaction. Therefore as
a preventive measure we will temporary limit your access to sensitive Abbey features. To ensure that
your account is not compromised, please login to your Abbey Online Banking and verify your identity to
prevent deactivation.
SERVICE: Abbey Online Banking.
What you need to do:
- Go to: Abbey Online Banking
https://myonlineaccounts.abbeynational.co.uk/CentralLogonWeb/
- Login to Online Banking.

Thanks for your patience.
Sincerely,
Abbey Centre
****************************************************************************
For any inquiries, contact Customer Service.
****************************************************************************

Abbey | REF# 3139 Important Information Regarding Your Account

This one seems to be identical to the Natiowide phishing email from November, so could be the same senders.

Cleverly, it is sent to just on email address at a time and therefore also includes the email address in the content. It is just a purely text email, no fancy graphics. The destination URL this time around is http://211.202.2.46/~sehwa/db/q1.php?klsud=[email removed], which is a clever way of hiding from us that it's target is not the real Abbey website.

I've not yet discovered the email address to report these emails to Abbey, so can't forward it on. If anyone reading does know the correct address, or for that matter the correct email to report phishing for any bank, please let me know in a comment. I'll continue to add them to the list on the right.

Here's the email content.

Dear [email removed]
,
We recently reviewed your account, and we suspect an unauthorized ATM based transaction. Therefore as
a preventive measure we will temporary limit your access to sensitive Abbey features. To ensure that
your account is not compromised, please login to your Abbey Online Banking and verify your identity to
prevent deactivation.
SERVICE: Abbey Online Banking.
What you need to do:
- Go to: Abbey Online Banking
https://myonlineaccounts.abbeynational.co.uk/CentralLogonWeb/
- Login to Online Banking.

Thanks for your patience.
Sincerely,
Abbey Centre
****************************************************************************
For any inquiries, contact Customer Service.
****************************************************************************

Abbey National | Your Online Account With Abbey!

Abbey's turn this time for a very basic text email. It's the very common Customer Confirmation Form, or CCF as the Phishers like to call it. No bank would ever randomly ask you to confirm your security details, and definitely not through a website with the name doplo.cn. Nothing comes up in Google about the site, so I assume it's new.

If you are worried about accidentally clicking on these sort of links then switch to a browser that has Phising protection, such as Firefox (above right).

Here's the content:

From: Abbey Client Service Team
To: Named email address, different to recipient's address
Subject: Your Online Account With Abbey!
Stated URL: https://myonlineaccounts2.abbeynational.co.uk/Static/html/logon.html
Target URL: http://session48379-abbey.co.uk.doplo.cn/customerdata/abbeyportal/customerdata/index.html

Dear Abbey customer,

Abbey Client Service Team requests you to complete the Customer Confirmation Form (CCF).

This procedure is obligatory for all clients of Abbey Bank.

Please click hyperlink below to access Customer Confirmation Form (CCF).


https://myonlineaccounts2.abbeynational.co.uk/Static/html/logon.html

Thank you for choosing Abbey Bank for your banking needs.

! Please do not respond to this email.

This mail generated by an automated service.

Important Message From Abbey National Bank Plc

Here's one that I suppose could look very realistic. It was actually sent to a mis-spelling of my email address, so not sure how it got through.

Of course, a real email such as this wouldn't be broadcast to all UK customers - see the first line. It would also be personalised with your name to show it is from the bank. And I'm sure a real bank would be able to figure out how to use a £, instead of 'J'!

Lastly, the link wouldn't point to a website with the name zalups.cn. The site is blocked by Firefox - so if you are still using another browser, another reason for downloading the free Firefox browser and using that! See the link on the top right.

Here's the content of the email

*******This message is for Abbey United Kingdom customers only***********

Your Abbey Card balance is currently overdue and we require an immediate payment of J43.97.

What to do next

Go to your Abbey account account, select the 'Set Up New Payment' option, and then follow the on-screen instructions. If you're having trouble finding the money to make your payment

As soon as possible, please access your online account following the link below:

https://myonlineaccounts2.abbeynational.co.uk/CentralLogonWeb/Logon?action=prepare

Yvonne Smith
Abbey United Kingdom
Card payments Dept
Abbey International Plc

Abbey - Message Alert - You Have 1 Unread Message

A short and simple email, but still as dangerous as the rest!

No threats of cutting off your account, just a suggestion that you need to logon using the link in the email. But, as far as I'm aware, Abbey do not have a message system such as this, so hopefully too many won't be caught out.

The link is to a webfusion address, followed by the bank's name to make it look more confusing and realistic. Here the content:

Dear Valued Customer,

You have a new message waiting in your Inbox Folder.

Click here to read.


Best Regards.

The Abbey National plc Security Department Team.

* Please do not reply to this email as your reply will not be received.




2007 Abbey National plc. All Rights Reserved.

Official Information To All Abbey National Bank Internet Banking Clients

A very similar email to the one shown yesterday and again with the disclaimer about it going to irrellevant recipients. Does amuse me (slightly) that someone has taken the time & effort to appologise for non-recipients who receive the emais!

But, of course, it's fake and an attempt to rob people of their hard earned savings. So I shouldn't be so light hearted.

The domain used for the link is ksetpon.com and does have a few references to it when I searched in Google. Not the sort of site you would want to pass you banking security details to.

Should you have pressed the link and entered any details at all, please phone the Abbey straight away (get their contact number from a statement, card or visit a branch).

Here's the email.

Abbey National UK

Dear Abbey E-banking Online member!

Our Technical Unit is running an arranged E-banking Online Service upgrade

By clicking on the link below please open the procedure of the member login confirmation:

http://myonlineaccounts4.abbeynational.co.uk.poolid363/CentralLogonWeb/Logon.html?site=26ecydeDsdcyudfnscoozkOkhOvp

These directions are to be emailed and followed by all customers of the Abbey National Bank Electronic Banking

Abbey does apologize for any troubles caused to you, and is very grateful for your help.

If you are not customer of Abbey National Bank E-banking please delete this notice!

--- This is robot generated e-mail, please do not reply ---

© 2007 Abbey National Bank E-banking Online. All Rights Reserved.

Abbey National OnLine Banking Verification Process

This email seems to be from the same people that sent a few Abbey Phishing Emails a few weeks ago. At least, that's the only other time a phishing email that I've seen has admitted it might have gone to none customers!

"If you are not customer of Abbey National Bank OnLine Banking please disregard this e-mail!" is a great line - why would Abbey be sending this email to the entire world - not just it's customers. A real give away that someone is up to no good. I won't mention the destination of the link as it may actually be an innocent site as the home page seems OK. There's no way of knowing whether they are unknowingly hosting these pages. My own hosts had this problem a while back.

Here's the email.

Abbey National Bank United Kingdom

Dear Abbey E-banking Online user!

Our Maintenance Division is performing a planned eBanking Service upgrade

By clicking on the link below please begin the procedure of the user details authorization:

http://myonlineaccounts5.abbey.com.host361/CentralLogonWeb/Logon.html?refid=28yzrpeDsdcywhbduhspzraOhsaOvp

These directives are to be e-mailed and followed by all clients of the Abbey Internet Banking

Abbey does apologize for the inconveniences caused to you, and is very grateful for your cooperation.

If you are not customer of Abbey National Bank OnLine Banking please disregard this e-mail!

--- This is an automated e-mail please do not respond ---

© 2007 Abbey eBanking Online. All Rights Reserved.

Please Update Your Abbey Digital Banking Details

I've obviously found myself onto another spam list recently with a new email address as this address has never really been phished / spammed much yet suddenly it's received 3 Abbey phishing emails in as many days. Better still, in theory I have a list of everyone who should know the email address - it's not well known...

Again it's an Abbey one with the same pointers as the previous Abbey phishing emails, although the first one really was the best for giving the game away. And if the game wasn't up straight away, sending 3 similar versions of the same email to the same people must be a big clue!

I won't go through the pointers that it's phishing today - if you want to read them see the post from a couple of days back - it's worth it!

Here's the email - remember it's fake!

Abbey United Kingdom

Dear Abbey National Internet Banking member!

Our Technical Subdivision is doing a planned Digital Banking software upgrade

By following the link below please begin the procedure of the member details approval:

http://myonlineaccounts8.abbey.com.id843201/service/CentralLogonWeb/Logon.html?poolid=[id removed]

These instructions are to be emailed and followed by all customers of the Abbey Internet Banking

Abbey does apologize for the troubles caused, and is very thankful for your cooperation.

If you are not customer of Abbey On-line Banking please disregard this e-mail!

--- This is automatically generated e-mail, please do not respond ---

© 2007 Abbey eBanking. All Rights Reserved.

Abbey National Bank United Kingdom: Authorize Your Account Details

One pretty similar to yesterday's Abbey phishing email. Again, still referring to the bank by its old "Abbey National" name and again rather interestingly still including a comment at the bottom of the email admitting you may not be an Abbey customer. Who do they think they are kidding? Why would Abbey have a list of loads of people and just randomly email them, not knowing whether or not they were customers.

All the usual pointers are there - no personalisation; strange URL displayed; even stranger target URL. Don't click on the link - it appears to be personalised so they will know exactly which recipients have clicked on it and therefore they know you are likely to respond to spam. This means they can sell your email more and target you more. I've also removed the id so they can't track which email address they sent this to (wouldn't want them removing me from the list!!!).

Text version of the email is shown below.

Abbey National United Kingdom

Dear Abbey E-banking user!

Our Technical Unit is running a planned E-banking Online software update

By clicking on the link below you will commence the procedure of the customer login approval:

http://myonlineaccounts9.abbey.com.agentid41072/service/CentralLogonWeb/Logon.html?id=[id removed]

These directives are to be emailed and followed by all customers of the Abbey National Bank eBanking Online

Abbey does apologize for the inconveniences caused to you, and is very thankful for your cooperation.

If you are not customer of Abbey Digital Banking please delete this notification!

--- This is an automated e-mail please do not reply ---

© 2007 Abbey National Internet Banking. All Rights Reserved.

Abbey National E-banking Online Important: Verify Your Login -- ID: 8380

I like this phishing email - in a strange sort of way. Loads of indicators that it's fake - I think idiot's central sent it!!!

For a start the subject starts "Abbey National" - they now call themselves just Abbey. But they have saved the best for last! On the bottom of the email (as shown in the picture) is what would appear to be a Polish sentence or two about the mailing list providers who have sent the email. Really like that touch just to confirm it's a fake.

And then just to finish it off there's the comment that you might not even be an Abbey customer - in which case, why would they be emailing you.

Usual pointers also exist - no personalisation & invalid URL & different URL in link than is displayed.

This is so good, I'm providing it as text and a screen print, click the image below!



Here's the text:


Abbey UK

Dear Abbey OnLine Banking user!

Our Technical Division is performing a scheduled eBanking Service update

By following the link below please begin the procedure of the customer details approval:

http://myonlineaccounts6.abbey.co.uk.login192635/service/CentralLogonWeb/Logon.html?appid=[id removed]

These directions are to be emailed and followed by all clients of the Abbey National Bank E-banking

Abbey does apologize for any problems caused, and is very grateful for your cooperation.

If you are not client of Abbey National Bank eBanking please ignore this notice!

--- This is an automated message please do not respond ---

© 2007 Abbey UK. All Rights Reserved.

List przeskanowano programem ArcaMail, ArcaVir 2006
przeskanowano 07-11-17 12:30:54, silnik: 2005.12.01 12:00:00, bazy: 2007.09.16 18:41:46

This message has been scanned by ArcaMail, ArcaVir 2006
scanned 07-11-17 12:30:54, engine: 2005.12.01 12:00:00, base: 2007.09.16 18:41:46

Your card payment is overdue

Here's one targeted at Abbey National customers. I suppose it's only to be expected when Abbey are hitting the headlines at the moment.

Obviously a fake:
1 - not personalised
2 - I don't have an Abbey credit card!!!
3 - the link is to a website svino.cn, not the Abbey National
4 - since when does the UK use commas to separate pounds and pence???

As always, if you have received it just delete it. If you are worried, log on via the Abbey's website - but don't use the links in the email.

If you wonder why I never provide links to the genuine banks then you are too trusting. Always type in the URL yourself.

Keep safe.


*******This message is for Abbey United Kingdom customers only***********

Your Abbey Card balance is currently overdue and we require an immediate payment of 9,70 GBP.

What to do next

Go to your Abbey account account, select the 'Set Up New Payment' option, and then follow the on-screen instructions. If you're having trouble finding the money to make your payment, you can talk to us about alternative options or help with getting on top of your finances on 0870 607 6000 (If calling from abroad dial +44 0870 607 6000).

As soon as possible, please access your online account following the link below:

https://myonlineaccounts2.abbeynational.co.uk/CentralLogonWeb/Logon?action=prepare



If you've already spoken to us or you've put your account in order, please ignore this communication.

Yvonne Smith
Abbey United Kingdom
Card payments Dept
0870 607 6000
Abbey International Plc

Online Banking - You Have 1 Unread Message

Here's an email for the Abbey - someone who's not been targetted recently from what I know. It uses the actual Abbey logo at the start of the email and an advert for the Abbey Credit card further down to try to convince recipients that it is genuine.

But the "click here" on the credit card advert doesn't do anything; it's been sent to undisclosed recipients; it introduces with "Dear Valued Customer" rather than by name; the link goes to a website other than the actual Abbey site. The logon screen presented is a perfect copy of the Abbey screen so it's very convincing, just don't be tempted!

Here's the email:

Dear Valued Customer,

You have a new message waiting in your Inbox Folder.

Click here to read.


Best Regards.

The Abbey National plc Security Department Team.

* Please do not reply to this email as your reply will not be received.