A word of warning RE: MBNA Credit Cards

Aquos76

Just received an email supposely from MBNA Europe this morning asking me to confirm my details. Something to do with a new security feature. There is a link included in the mail.

DO NOT FILL THIS IN. I have been on to MBNA this morning and they say that this mail is not from them and they know about it since yesterday.

The best thing to do is ring them up and confirm that you received it.

eth0_

Good advice, but I don't think you'll help anyone avoid this by posting it in the satellite forum :OP
Make a new thread in business and finance, a mod here will delete this thread for you

Sleipnir

yeah was posted yesterday also.
Banks will never send an email to their customers requesting them to enter their details.
Never, never, never fill them in.

Aquos76

Damo you may move this if you feel you have to, but there are many here that might find this information applies to them . I'll leave it up to you.

Thanks for the advise eth0_

I will also post in the revelant section.

Phibsboro

just a quick clarification - this is a really sophisticated fraud - it does not ask you to mail in your logon details. Instead it says that they have upgraded their security and are asking to logon yourself re-register yourself. The link is offered as a coutesy. If you check the the link it does indeed point to mnba website. I don't have a card but if I did I might have clicked through at that point. My partner does have one tho so I just assumed it was for them. My natural caution suggested a further look tho and I checked the proerties of the link - after the mnba bit it had a pile %xx's. These are ascii codes (I think) that become part of the url but are not obviously visible as such. Although the game was given away slightly by some spurious text in the url (something about religion i recall).

Either way, I'm well savvy to these things and nearly clicked this - it will be the most successful password gatherer yet I'd say.

Colm

Capt'n Midnight

Unless you have the latest patches for internet explorer (and even them maybe) you are vunerable to a bug which displays a fake address in the address bar.

That's right - for about 4 months before the latest IE patch you could click on an innocent looking link and you would be taken to something that looked like the real web site ie. the scammer had simply saved, the real home page, edited it and put it back on thier site - the address bar wouldn't tell you different ...

Firebird / Firefox / mozilla is not suceptible to this faked address link AFAIK

cf. http://www.antiphishing.org/

http://www.ftc.gov/opa/2003/07/phishing.htm

The FTC alleged that the scam, called “phishing,” worked like this: posing as America Online, the con artist sent consumers e-mail messages claiming that there had been a problem with the billing of their AOL account. The e-mail warned consumers that if they didn’t update their billing information, they risked losing their AOL accounts and Internet access. The message directed consumers to click on a hyperlink in the body of the e-mail to connect to the “AOL Billing Center.” When consumers clicked on the link they landed on a site that contained AOL’s logo, AOL’s type style, AOL’s colors, and links to real AOL Web pages. It appeared to be AOL’s Billing Center. But it wasn’t. The defendant had hijacked AOL’s identity and was going to use it to steal consumers’ identities, as well, the FTC alleged.

The moral of the story
- if you get an unsolicited email with a link in it - M$'s recommend workaround if for you to type in the link rather than clicking on it.

No reputible company will send an email asking for you to reenter details - if they do (and it is not in plain text format) FLAME THEM - its the old stolen pass card trick - "bank" rings customer "back" to arrange a new card - and as a "security check" asks for the pin number....

How Not to Get Hooked by a 'Phishing' Scam
http://www.ftc.gov/bcp/conline/pubs/alerts/phishingalrt.htm

http://www.theregister.co.uk/content/55/35253.html

The syntax http(s)://username:password@server/resource.ext has legitimate users but is also frequently used in phishing scams.

The problem is compounded by an unpatched security vulnerability which could be exploited to display a fake URL in the address and status bars of IE.

Rather than fix that specific flaw, which first emerged almost two months ago, Microsoft is ditching an entire approach. This is a radical step that will cause considerable inconvenience to the minority whilst frustrating one particular technique for making password harvesting scams appear more plausible.

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q834489

http(s)://username:password@server/resource.ext
A malicious user might use this URL syntax to create a hyperlink that appears to open a legitimate Web site but actually opens a deceptive (spoofed) Web site. For example, the following URL appears to open http://www.wingtiptoys.com but actually opens http://example.com:

http://www.wingtiptoys.com@example.com

Dac51

I had a similar e-mail from ebay recently although I didn't follow through with the link supplied. Be warned!!

JohnDigital

If anyone is interested here is a copy of one of the emails I received, note the poor grammar and the link which is shown at the bottom is not actually to MBNA at all. When you put an @ in the line you can write anything to the left of it and the link will work which can easily confuse lots of people. Look out for the @ it will never be found in a legitimate URL. I have received them from lots of sources pertaining to be different Banks, Paypal or Ebay there is a lot of this sort of thing going on.

I never got the scam mail and did not contact mbna about it so this must be a general e-mail they are sending around on foot of what happened.

Dear Customer,

At the start of this week, a limited number of our Customers received an
e-mail claiming to be from MBNA asking them to divulge personal information via hoax internet sites. Upon discovery of this, we took steps to close down the sites to which Customers were being directed.

If you received this e-mail and you did not click on the attached link, you do not need to take any further action.

If you did click on the link please contact us via the Customer service number on the back of your credit card or on your statement.

This was not a breach of MBNA security, but was an attempt by a third-party to extract information from our Customers whose personal e-mail addresses had been randomly generated. This type of attempted fraud has been carried out with other UK and US banks over the last year. If you would like to know more about the measures we take to protect your personal information, take a look at our Internet Safety Information by visiting www.mbna.co.uk.

We would also like to advise that MBNA Net Access is a secure online banking site, validated by the Secure Server Certification Authority and this will always be confirmed by the presence of the 'Padlock' icon located at the bottom of your browser.

We hope that your mind has been put at rest over this matter, but if you have any questions, please contact us. Again, please be aware that we will never ask you to divulge your security information through e-mail communication.

Yours sincerely,

Peter McCready
Head of Internet

MarkR

Originally posted by Earthman
Peter McCready
Head of Internet [/B]

Wow... Head of the internet.

icdg

LOL!

In all seriousness, this should not be in the Satellite forum. Thread moved to Boards.ie's Society/Business and Finance forum.

Aquos76

Are you telling me that people in the satellite forums should not be aware of this information. As I mainly use the Sat section I felt that if I could help the users whom I have dealings with, I would. As I also posted in the Bus/Finance section I cant see a problem. But as you are the Boss I suppose you know best.

John R

The lousy English in that email is more than enough to raise suspicions.

De Rebel

Received (and ignored) the original MBNA one. Received a variation yesterday, claiming to come from Barklays On Line banking.

Curious thing is, both of these arrived to an e-mail address that has never been spammed before.