Internet bankers face new phishing scam

Internet bankers face new phishing scam

Hi-tech fraudsters have developed a new way of tricking customers who go online to do their banking, analysts warned yesterday.

A "Trojan horse" programme insinuates itself into a user's computer via an email and directs the customer to a fake bank website.

When the customer enters passwords and account numbers, the crooks pick them up and use them.

The technique is the latest example of "phishing", which is costing financial institutions across the world many millions of pounds every year.

A common trick is to draw computer users into a bogus website, for instance by sending emails to customers claiming they are overdrawn. The banks have invested time and money in making clients aware of this tactic.

But Alex Shipp, a senior anti-virus technologist at MessageLabs, which specialises in email security, said the beauty of the new scam was that it did not require computer users to seek a website but forced them to it without their knowledge.

The Trojan horse programme enters a computer via an email. In the case MessageLabs examined, which cropped up in Brazil last week, the email was completely blank.

Once opened, however, the programme secretly overwrites the website address for any bank whose details are stored in the computer with the bogus website's details. The next time the user tries to go to the site of their bank, they end up instead at the false site.

Mr Shipp said: "It could prove more dangerous than.....continued below

Advertisement starts

---

---

Advertisement ends

other phishing attacks because it uses a new technique."

MessageLabs is advising all computer users to make sure they have adequate anti-virus software and up-to-date security patches.

Mr Shipp said it was possible that the attempted cons could spread. The fraudsters often target one country, hone their technique and then expand. In the early days of "phishing" Australia was a favourite target of the con merchants, but South America is now popular.

Last month police in Brazil announced they had arrested 53 people in connection with the theft of around £16m in phishing scams.

Guardian Unlimited © Guardian Newspapers Limited 2004