Halifax PLC | **VERY IMPORTANT SECURITY NOTICE**

This one is a different idea for a scam. It first warns the read about phishing emails before providing the phishing link part way down. No threats of violence or account cut off if you don't answer security questions, just a 'please help us' part way down the email.

Here's the cheeky email content!

Be on your guard - beware of fraudsters!

Dear Halifax customer,

Like other UK banks, we are currently seeing very large numbers of "phishing emails" in circulation. Many of these look as if they are from Halifax, typically encouraging you to click a link and type in your logon details. Such attempted frauds only work if you click that link, and you then type in your full security details & contact information.

Please remember: We never ask you to enter your Credit Card information & contact information on the Internet or over the phone. To learn how to protect yourself against "phishing" and other "identity theft" please spend a few minutes to upgrade to our latest security.

Click here to help us fight fraud!

Best regards.

Halifax Bank Security Department Team.

* Please do not reply to this e-mail *

------------------------------------------------------------

Halifax Bank or Halifax Bank plc is authorised and regulated by the Financial Services Authority and signatories to the Banking Codes. FSA authorisation can be checked on the FSA’s Register at: www.fsa.gov.uk/register. Halifax Bank or Halifax Bank plc is member of the Financial Services Compensation Scheme and the Financial Ombudsman Service. Halifax Bank plc

| Halifax Bank© 2008 |

Halifax Fraud Prevention Unit

Time for the Halifax to make another rare appearance on these pages. The English grammar is a bit ropey in this email - maybe it's not sent from an English speaker. For example, apologize for any inconveniences caused and our Customers account instead of our Customers' accounts, to name but two. But then I am picky about such things!

Remember, no bank would send you an email asking for further security information - any such email should always be treated as an attempt to rob you. If such measures were needed, they would contact you via the post.

The actual destination of the link is http://static-68-179-55-204.ptr.terago.net/halifax-online.co.uk/_mem_bin/halifax_LogIn/formslogin.aspsource=halifaxcouk/ so I think someone might be using an ISP's free hosting space to host the landing page. Here's the email content.

Dear Customer

Halifax PLC. has been receiving complaints from our customers for unauthorised use of the Halifax Online accounts. As a result we are making an extra security check on all of our Customers account. In order to protect your information please click on the link below:


http://halifax-online.co.uk/_mem_bin/halifax_LogIn/formslogin


Thank you for your understanding and correspondence, we also apologize for any inconveniences caused.

Thanks for your co-operation.

Fraud Prevention Unit
Legal Advisor
Halifax PLC.

Halifax | This confirmation email has been sent as a security precaution.

The Halifax don't often feature on my list of phishing emails, but here's one. And what a cheap and nasty phishing attempt it is! The link isn't clickable and clearly points to something other than the actual bank - http://host-69-144-30-10.glt-wy.client.bresnan.net/halifax-online.co.uk/. Looking through Google, there are other reports of redirects on that website being hacked to point to the phishing websites.

The email is very basic - the sender obviously has no idea of how to create paragraphs in the email - so it doens't look at all official. The content is designed to panic people, but I hope that the cheap look and the lack of a link is going to help to stop people copying the link and falling for the trick!

I suspect that the sender has copied some text from a genuine Halifax email and tried (but failed) to use that. The best bit, considering the content added by the sender, is the copied line "Halifax would never send you an email asking you to verify your secure online banking details" - it says it all really! That's probably the most honest bit of the email!

Here's the email:

Dear customer, Thank you for confirming your telephone contact details. If you have made any amendments to your contact details these have now been updated. Please note that if you hold any joint accounts, only your details will be updated. This confirmation email has been sent as a security precaution. If you did not make this number change/confirmation, please visit the website below, phone lines are open 24 hours a day, 7 days a week. http://host-69-144-30-10.glt-wy.client.bresnan.net/halifax-online.co.uk/ Regards, Halifax Online Helpdesk FIGHT ONLINE FRAUD Please do not reply to this email address as it is not monitored and we will be unable to respond. Halifax would never send you an email asking you to verify your secure online banking details. Calls from BT landlines will cost a maximum of 4p per minute and a 6p call set-up fee. The price of calls from other telephone companies will vary. The call price is correct at 25/10/07. . -------------------------------------------------------------------------------------------------------------------- Bank of Scotland plc, Registered in Scotland Number SC327000 Registered office: The Mound, Edinburgh EH1 1YZ. Authorised and regulated by Financial Services Authority

Halifax | Message from Halifax Online

Well here's a (fake) claim that Halifax have received security complaints and are taking actions. Of course, the whole point is to breach your security, not protect you.

The URL the link points to is http://toroon12-1168099092.sdsl.bell.ca/halifax-online.co.uk/_mem_bin/halifax_LogIn/formslogin.aspsource=halifaxcouk/

Presumably this means the security on bell.ca has been breached! No doubt that will get quickly plugged!

Here's the content of the email.

Dear Customer

Halifax PLC. has been receiving complaints from our customers for unauthorised use of the Halifax Online accounts. As a result we are making an extra security check on all of our Customers account. In order to protect your information please click on the link below:


http://halifax-online.co.uk/_mem_bin/halifax_LogIn/formslogin


Thank you for your understanding and correspondence, we also apologize for any inconveniences caused.

Thanks for your co-operation.

Fraud Prevention Unit
Legal Advisor
Halifax PLC.


ref i-cmr

Halifax | Online Banking - You Have 1 Unread Message

The Halifax seems to be a new sudden victim of a few Phishing emails.

This one has gone to some effort to look the part, but gives the game away as the email has been sent to 10 different "keith" email addresses - only 1 of which is mine! Of course, as I frequently say, no respectable financial institution would greet you in an email with 'Dear Valued Customer' - it would be by your full name.

It takes the form of various Abbey Phishing Emails of a few months ago in that it doesn't tell you anything, it just claims there's a message that needs your attention.

The destination URL is http://halifax-onlines.com/halifax-online.co.uk/_mem_bin/formslogin.asp_source=halifaxcoukHOME/account.php. halifax-onlines.com is obviously a very clever domain name - it looks very realistic, but it does already appear in several Phishing results on Google.

Here's the email content:

You have a new message waiting in your Inbox Folder.

Click here to read.

Best Regards.
Halifax Banking plc Security Department Team.

* Please do not reply to this email as your reply will not be received

Halifax customer service: online banking notification!

First we had the NOF, now we've got the HOF. The HOF looks just like the NOF phishing email, just with the bank's name changed to 'Halifax'.

This time around the target URL is http://halifax.co.uk.sistemlog6.ms/_mem_bin/onlineform.asp?source=[removed] - sistemlog6.ms being a site that appears in a few Phishing results on Google.

The email is at least addresses on the to: section just to my email address and displayed the name part (before the URL) to try to make it more convincing. but 'Dear Halifax bank customer' is not how a bank would address a customer.

As always, no bank would send an email like this. It is purely an attempt to empty your account of funds and maybe even steal your identity. Don't click the link. If you are worried about accidentally clicking these links, use a phishing safe browser such as Firefox (free download from the button on the right).

Here's the content of the email.

Dear Halifax bank customer,

We have implemented security measures consistent with our internal information security practices to help us keep your information secure. These measures include technical and procedural steps to protect your data from misuse, access or disclosure, loss, alteration or destruction.

One of these security measures is HOF (Halifax Online Form) to help us to keep your personal and banking data up to date.

You should complete HOF on a regular basis.

Please complete HOF using the link below:

Halifax Online Form

Halifax Automated Mail Service. Please do not respond to this mail.

ref cmr

Halifax | IMPORTANT SECURITY ALERT

This one has taken the time to put a Halifax banner across the top of the email - along with a picture of the guy from their adverts. There's also some waffle down the bottom about needing Flash 5 to access the site. This has been taken from the bank's own website, but it's over ayear out of date. Must be a phishing template from some time ago...

The email tries to make out that the recipients Halifax Bank Account has been subject to some attempted breach of security, and that these actions are to reinstate access to the account. This sort of email would never be sent. If a bank had reason to suspend access to an internet account system they would do so, then post the new security details via Royal Mail (been there, had it happen). So don't fall for this trick.

In this case the target URL is http://stolnick-8marta-8b-r1-c1-45.ekb.unitline.ru/halifax-online.co.uk/_mem_bin/halifax_LogIn/formslogin.aspsource=halifaxcouk/ - but I've no idea what unitline.ru is nor whether it is just an innocent website that's been hikacked for this purpose. Looks like that might be the case.

Anyway, leave the link and delete the email.

IMPORTANT SECURITY ALERT

--------------------------------------------------------------------------------

Please note that our system recently noted that your attemption of signing on to your account was failed while some errors occured during the processing update of your online account you are having with our bank..

We sincerely here by to notify you that you should kindly follow below link to update your online account for your security safety ensured by our financial insititution.


https://www.halifax-online.co.uk/_mem_bin/FormsLogin.asp?source=halifaxouk

Thank you for your prompt attention to this matter. Please understand that this is a security measure meant to help protect you and your account.

We apologize for any inconvenience.

If you choose to ignore our request, your account may leads to be temporarily suspended

Halifax | Unauthorised Use Of Your Halifax Online Account

This is, I think, the first time that the Halifax has apepared as a target on these pages.

This one, sent a couple of days ago (delayed posting due my holiday!!!) tries to panic the recipient into believing they have to immediately check that no-one has been able to get at their cash.

It's sent to 'Dear Customer' and 'undisclosed-recipients' - what sort of warning email would really be sent like that?

The actual destination URL is http://68-185-94-70.dhcp.scrm.ca.charter.com/halifax-online.co.uk/_mem_bin/halifax_LogIn/formslogin.aspsource=halifaxcouk/

charter.com seem to be a respectable site, who themselves have been the targets of phishing emails from what their site says. I presume they will quickly close down these extra pages - if not already done so. I'm guessing though that someone has hacked their site and posted these pages without the site owner's knowledge.

Here's the content of the email:

Dear Customer

Halifax PLC. has been receiving complaints from our customers for unauthorised use of the Halifax Online accounts. As a result we are making an extra security check on all of our Customers account in order to protect their information from theft and fraud.


Due to this, you are requested to follow the provided steps and confirm your Online Banking details for the safety of your Accounts. Please Click Here To Start .


However, Failure to do so may result in temporary account suspension. Please understand that this is a security measure intended to help protect you and your account. We apologize for any inconvenience.

Thanks for your co-operation.

Fraud Prevention Unit
Legal Advisor
Halifax PLC.