Tiscali Scambusters

How to spot a phishing email

Shown below, is a recent phishing email purporting to be from Halifax building society. Everything about this communication and the website it links to, seems real. Remember though, a bank will never ask you to update any personal details or information online. Read on to find out how you can spot a phishing attempt. You can also see how Norton 360 spotted a phishing attack and helped block it.

The email

An email, body shown above, arrives in your inbox purporting to be from the Halifax building society. As your account is about to expire (online bank accounts don't expire), you need to click on the link to continue using the service.

The website

The screenshot above, mirrors the exact look and feel of the real Halifax website. You're lead to believe that nothing is amiss here, so time to login, handing over your username, password and and one of your security questions to the scammers.

The URL

http://www.halifax.co.uk looks real doesn't it. The main thing that gives it away is that there's a missing 's' on the http. This site therefore isn't secure as all banks will use the https prefix, showing that the website is safe to use when entering personal details. You should also note the address has a lot more characters after the halifax.co.uk and before the first /. So this page isn't halifax.co.uk at all; in fact it is hosted at formsloginasp.net.

More details

After successfully sending your login details to the scammers in the example shown above, this phishing website now attempts to gather everything else it'll require to ensure they can access your bank account with ease.

All done

They now have full access to your bank account with the details you've supplied through the phishing website.