Problem with BOI365 site

vetstu

When I go on it asks for user ID and DOB as normal but there is also a step 3 Full Pin. Computer is scanned constantly with Sophos so don't think we have a virus. I didn't put anything in but rang the customer services about it I was told that the online team goes home at five and to ring back in the morning. Went to the site by typing in www.365online.com and all but it still comes up. Anyone else getting this?

Sasquatch76

Just tried it there. I was asked for three digits of my six digit pin as the usual step 3.

wayne0308

vetstu wrote: »

When I go on it asks for user ID and DOB as normal but there is also a step 3 Full Pin. Computer is scanned constantly with Sophos so don't think we have a virus. I didn't put anything in but rang the customer services about it I was told that the online team goes home at five and to ring back in the morning. Went to the site by typing in www.365online.com and all but it still comes up. Anyone else getting this?

It's very strange your being asked for your full pin. You may be redirected to a scam site, it's only ever asked me for 3 numbers of my pin and I've been using it for years. Something is definitely not right. Just checked it there also and it only asked for 3 digits too.

vetstu

Yeah, tried it a different computer and it comes up as normal. Still the same on the first computer despite a virus scan coming up clean

Ste.phen

Then your virus scan isn't picking up whatever virus it is, that's absolutely not what the BOI site is doing (logged in earlier myself)

Kila

Can you take a screen shot and post it here of the page asking for your pin? (press Print Screen button and paste into an image program. Even MS Paint will do).

Or, failing that, maybe post the URL it's redirecting you to?

That could help us identify if there is a problem with you being redirected to a scam site, as we could compare with legit URLs.

vetstu

Sorry. It turns out that my brother hasd disabled the sophos updater, when I updated it and ran it it picked up one virus, when it was cleared the site was back to normal.
In response to Kila it was not directing me to any scam site, it was simply injecting extra code into the 365 page, the address was as normal. i will post a screenshot when I get on the other computer in a few minutes

vetstu

Here is the screenshot

and the virus found was
20100510 211811 File "C:\Documents and Settings\User\Local Settings\Temp\0.8162281411303431.exe" belongs to virus/spyware 'Mal/EncPk-OC'

wayne0308

vetstu wrote: »

here is screenshot

It doesn't even split the steps up. For me when I log in, it shows step 1 and step 2 on the first page then you click next and enter your pin at step 3 and click enter.

Just show's it pays to have antivirus, some people don't bother.

seamus

That's pretty clever, most people wouldn't even blink and would go ahead and put in their full pin.

Luckily there's no way of transferring money out even if you do have a PIN (because all new payee accounts have to be verified), but with enough other information, they could ring up and impersonate you and hijack the account.

Kila

A clever virus that would probably catch a good few people. Just as well the updated AV program caught it, and that you were canny enough to investigate rather than just blindly enter your pin.

BnB

vetstu wrote: »

Here is the screenshot

and the virus found was
20100510 211811 File "C:\Documents and Settings\User\Local Settings\Temp\0.8162281411303431.exe" belongs to virus/spyware 'Mal/EncPk-OC'

Very well done on spotting it Vetstu.

I'd say most people wouldn't have.