Phishing ("Abbey National") warning

This appears to be doing the rounds. ClamAV describes it as Email.Phishing.DblDom-31. Don't fall for it!

Dear Abbey bank customer,

Abbey Customer Serice would like to inform you that we are currently carrying out a scheduled upgrade of Abbey Security software.
In order to guarantee high level of security to our customers, we require you to complete �Online Banking Form�.
Please complete Online Banking Form using the link below:

Online Banking Form

Thank you for being a valued customer.

Sincerely,
Abbey Customer Service

0x5, 0x93, 0x6596, 0x8859 w, ffpu, root, cq, api, krmmd, uzxzd, tmp, tpeuq, cvs, k 0x6040, 0x0884, 0x3, 0x8238, 0x2320, 0x96, 0x6844, 0x0960, 0x39, 0x93, 0x5, 0x4583, 0x96, 0x4831, 0x22929091, 0x63458860, 0x7 0x9, 0x0697, 0x2692, 0x25270610, 0x69504792, 0x3, 0x58, 0x7, 0x4945, 0x7, 0x99, 0x52, 0x7, 0x76, 0x6933 0x97, 0x78 0x6819, 0x1, 0x1, 0x31, 0x3, 0x8136, 0x0736, 0x81629513, 0x2846, 0x96, 0x98, 0x5, 0x2885, 0x58, 0x4307, 0x12, 0x5, 0x80457890 0x74, 0x5, 0x01041274, 0x75, 0x9, 0x1, 0x1, 0x9, 0x6626, 0x96, 0x99, 0x2158, 0x16, 0x32, 0x26079796, 0x17, 0x08633055, 0x1 0x9, 0x7, 0x11, 0x7, 0x59, 0x5, 0x9, 0x1 0x7, 0x52, 0x2427, 0x66366316, 0x5, 0x18, 0x78, 0x2580, 0x21608325, 0x11, 0x2562, 0x0579 0x4498, 0x9, 0x97, 0x3, 0x96, 0x4019, 0x0661, 0x0343, 0x23438341, 0x8705, 0x09485940, 0x91, 0x5, 0x1, 0x1, 0x3

0x6174, 0x02732421, 0x40205083, 0x29551881, 0x9, 0x9, 0x21803376, 0x9, 0x39 0x5, 0x92, 0x91, 0x64530795, 0x76, 0x2304, 0x14, 0x6006, 0x8500, 0x38, 0x8906, 0x1, 0x90 0x21150603, 0x65673736, 0x6984, 0x0434, 0x1, 0x49910015, 0x5, 0x1, 0x36, 0x50, 0x1, 0x1, 0x5, 0x8394 update, fono 0x62775886, 0x03370004, 0x84745750, 0x5, 0x73, 0x78, 0x95, 0x9, 0x76, 0x9, 0x40379398, 0x04282903, 0x6321, 0x80882499, 0x2832, 0x37, 0x9 0x56, 0x57, 0x39, 0x06704055, 0x7, 0x7, 0x75, 0x8794, 0x5, 0x2341, 0x31, 0x9, 0x89279117, 0x8615, 0x5, 0x81017918, 0x3 0x65420672 tmp, d, xnrln, fwo, exe, function, stack, common 0x6675, 0x2476, 0x02258459, 0x7, 0x00040247, 0x1, 0x4518, 0x9, 0x81223386, 0x40051849, 0x8537, 0x0053 0x91, 0x61377441, 0x7, 0x9, 0x4101, 0x11, 0x32, 0x85195431, 0x5, 0x66168941, 0x1, 0x99, 0x76, 0x5, 0x93, 0x06975810, 0x17, 0x1, 0x64615606 0x26475937, 0x76, 0x14, 0x0484, 0x04759658, 0x31, 0x9, 0x36, 0x03602580

0x48052056, 0x5, 0x1, 0x71, 0x7, 0x34, 0x99, 0x44109147, 0x6132, 0x5 0x8318, 0x8888, 0x9, 0x88447741, 0x8717, 0x6540, 0x20944596, 0x1, 0x97, 0x80810416, 0x1, 0x0372 0x0891, 0x9, 0x5, 0x4848, 0x65177122, 0x6157, 0x40744789, 0x72, 0x1, 0x3, 0x38, 0x12, 0x54, 0x7, 0x44814880, 0x0788, 0x6718, 0x4466 0x79, 0x24260581 start, rev 0x2376, 0x87391507, 0x2277, 0x94, 0x0073, 0x9, 0x78 0x6204, 0x16, 0x17, 0x71 0x9, 0x9, 0x53, 0x90, 0x1, 0x53, 0x4296, 0x98 common, zcoxd, tmp, define, umvf, start 0x69543166, 0x33, 0x7, 0x7, 0x4358, 0x68451493, 0x7 0x8448, 0x60850870, 0x5, 0x6907

0x97, 0x64943465, 0x5, 0x4639, 0x31, 0x5 0x79, 0x02417561, 0x54, 0x2285, 0x7, 0x1 0x1, 0x4345, 0x5, 0x68262800, 0x55, 0x6100, 0x7, 0x1, 0x9, 0x79, 0x1, 0x01767458, 0x24125288, 0x71 0x68335294, 0x0744, 0x0957, 0x4299, 0x1

Edited by ARD (Sat 04-Oct-08 14:01:08)

Thanks for that

I've seen that one (coming from a Yahoo! email address when you dig was a give away )and get numerous others 'from' various banks most days.

Hopefully 'most' people just delete these emails - fortunately the IE7 phishing filter would normally save those that haven't a clue...

I've just heard from the "Abbey" again. As you say, it was from a yahoo.com address that I've now blocked on the server but if they're coming from various addresses there's not a lot folks can do except delete them.

Doesn't the dodgy English set off alarm bells for most people?

You can't have read many forum posts.

There are new Net users every day. Often they�ve jumped straight in at the deep end with a DSL Max product purchased with their sparkling new desktop from PC World or a free laptop from AOL/Carphone Warehouse. An increasing number of people are banking online as High Street branches close. Phishing scams like this, however obvious to long-term Net users, should always be highlighted.

Don't get me wrong; you make good points. I actively pursue phishing by reporting it, and have myself worked on the Castlecops PIRT effort. http://www.castlecops.com/pirt

But I can't shake off the implied insult to my intelligence conveyed by the poor English and bad grammar of so many spams and phishes. Sadly, literacy and awareness of good English aren't especially widespread, but all the same, these are useful credibility filters when presented with an exhortation to update your details.

The bottom line, however, is that your bank, building society or whatever will NEVER send an email asking you to visit a website to confirm your details.

And, unfortunately, your target audience of newbies with their shiny new PCWorld/Carphone Warehouse kit won't be reading this excellent forum.

Somebody, somewhere just might be glad to see my puny little post. Not everybody has your astonishing intellect.

You seem to think Xris was being disparaging, that wasn't the view I formed.

A problem with these alerts is that there are dozens per week. I've received the following 8 times today so far.

" Important News about the Open Banks Enterprises Banking Centers.
New Security Release:

This is to inform you that Open Banks Enterprises Banking recently agreed to use 128 SSL 2008 VeriSign for all Open Banks Community Customers.
The Banking Centers will become fully protected after the close of business on Tuesday,October 07, 2008.

For those of you who have accounts located at one of the Open Bank Enterprises banking centers - please download Log In certificate today:

Download now>>>

Sincerely, Octavio Foster.
2008 Openbank/com/org/net Community"

Ah yes, and I've had several very similar allegedly from Standard Bank too.

Thanks for the moral support; indeed, I hadn't intended to be disparaging, I believe that if we actively retaliate by reporting these then we have some chance of actually closing down the phishing sites, which is rather more effective than just filtering them.

Knujon's efforts, for instance, have led to the rogue registrars behind "canadian pharmacy" type websites being closed down,