50. Phishers / 2004LATEST UPDATESFRONT PAGE  To Front PageTo CIA Archive  CIA MENU

| 1 NatWest | 2 Abbey National | 3 Barclays | 4 Halifax | 5 Citibank | 6 FleetBank | 7 Suntrust Bank | 8 US Bank | 9 Lloyds TSB | 10 Nationwide | 11 Citizens Bank | 12 HSBC | 13 Woolwich | 14 Washington Mutual | 15 PayPal |

/1 [Natwest]
user-support42@natwest.com
Subject: !To all Natwest Bank users


The whole object of the exercise is to get customers of the bank to log on to a bogus website which looks exactly like the bank's and cough up account details, passwords, pin numbers and anything else the phishers can think of. Here are some more:

| 1 NatWest | 2 Abbey National | 3 Barclays | 4 Halifax | 5 Citibank | 6 FleetBank | 7 Suntrust Bank | 8 US Bank | 9 Lloyds TSB | 10 Nationwide | 11 Citizens Bank | 12 HSBC | 13 Woolwich | 14 Washington Mutual | 15 PayPal |

/2 [Abbey National plc]
user-supports3@abbey.com
Subject: Abbey account details confirmation


| 1 NatWest | 2 Abbey National | 3 Barclays | 4 Halifax | 5 Citibank | 6 FleetBank | 7 Suntrust Bank | 8 US Bank | 9 Lloyds TSB | 10 Nationwide | 11 Citizens Bank | 12 HSBC | 13 Woolwich | 14 Washington Mutual | 15 PayPal |

/3a [Barclays]
users-billing7@barclays.co.uk
Subject: official Notice for all Barclays IBank users!

Here's a variation: the original message is text/html. The graphic shows how it appears on the screen

3b Barclays IBank
user-supports6@barclays.com
Subject: to users of Barclays IBank!
Sent: Tue, 13 Jul 2004 13:20:04 +0100

This is what the text actually says (including the invisible bits)

Details Confirmation I'll take this one

SECURITY ALERT: PIease read this important message

As the Technical service of bank have been currently updating the software, we kindly ask you to follow the reference given below to confirm your data, otherwise your access to the system may be bIocked. Windows Me Love Poems

PIease foIIow the link below to fill the form "DetaiIs Confirmation": Let's face facts.

http://www.personaI.barcIays.co.uk/goto/pfsoIb_Iogin

well in 1921 MIRC

| 1 NatWest | 2 Abbey National | 3 Barclays | 4 Halifax | 5 Citibank | 6 FleetBank | 7 Suntrust Bank | 8 US Bank | 9 Lloyds TSB | 10 Nationwide | 11 Citizens Bank | 12 HSBC | 13 Woolwich | 14 Washington Mutual | 15 PayPal |

/4a [Halifax]
users-billing18@halifax.co.uk
Subject: Halifax Internet banking official updates


This variation comes in a variety of guises

/4b1 Halifax
operator_6395832737@halifax.co.uk
Subject: Urgent Notification From BiIIing Department

/4b2 Halifax bank
antifraud.ref.num6494162@halifax.co.uk
Subject: ATTENTION Halifax Internet banking CLIENT


Holocaust As far as I know What's the difference? Santa Claus Tour de France

| 1 NatWest | 2 Abbey National | 3 Barclays | 4 Halifax | 5 Citibank | 6 FleetBank | 7 Suntrust Bank | 8 US Bank | 9 Lloyds TSB | 10 Nationwide | 11 Citizens Bank | 12 HSBC | 13 Woolwich | 14 Washington Mutual | 15 PayPal |

/5a Citi Identity Theft Solutions
admin@citi.com
Subject: Citibank: Urgent Message!


Recently there have been a large number of identity theft attempts targeting Citibank customers. In order to safeguard your account, we require that you update your Citibank ATM/Debit card PIN.

This update is requested of you as a precautionary measure against fraud. Please note that we have no particular indications that your details have been compromised in any way.

This process is mandatory, and if not completed within the nearest time your account may be subject to temporary suspension.

Please make sure you have your Citibank ATM/Debit card and recent statement at hand.

To securely update your Citibank ATM/Debit card PIN please go to:

https://www.citibank.com/signin/citifi/scripts/login2/update_pin.jsp
[http://61.128.198.62/verify/]

Please note that this update applies to your Citibank ATM/Debit card - which is linked directly to your checking account, not Citibank credit cards.

Thank you for your prompt attention to this matter and thank you for using Citibank!

Regards,

Dorothy Manuel
Head of Citi® Identity Theft Solutions


Copyright © 2004 Citicorp. All rights reserved.
Do not reply to this email as it is an unmonitored alias.

here's a variation

/5b Citibank
citisafe@citibank.com
Subject: Urgent Update: CitiSafe by Citibank!

Date: Sun, 4 Jul 2004 02:32:36 +0100

Dear Citibank Customer,

We recently noticed one or more attempts to log in to your Citibank account from a foreign IP address and we have reasons to believe that there was attempts to compromise it with brute forcing your PIN number. No successful login was detected and you have full protection by now. If you recently accessed your account while travelling, the unusual login attempts may have been initiated by you.

The login attempt was made from:
IP address: 171.97.187.24
ISP Host: cache-92.proxyserver.cis.com

By now, we used many techniques to verify the accuracy of the information our users provide us when they register on the Site. However, because user verification on the Internet is difficult, Citibank cannot and does not confirm each user's purported identity. Thus, we have established an offline verification system to help you evaluate with whom you are dealing with. The system is called CitiSafe and it's the most secure Citibank wallet so far.

If you are the rightful holder of the account, click the link bellow, fill the form and then submit as we will verify your identity and register you to CitiSafe free of charge. This way you are fully protected from fraudulent activity on all the accounts that you have with us.

Click to protect yourself from fraudulent activity!

To make Citibank.com the most secure site, every user will be registered to CitiSafe.

NOTE! If you choose to ignore our request, you leave us no choice but to temporally suspend your account.

*Please do not respond to this e-mail, as your reply will not be received.

Regards, Citibank Customer Support

here's another type based on a graphic

/5c Citi
user-billing37@citibank.com
Subject: from Citibank.

Thu, 15 Jul 2004 01:16:58 +0300


Charlie's Angels UFOS in 1962 If you'd like Brad Pitt

/5d CITI
identdep_op2@citibank.com
Subject: CitiBank Customer Notice: DetaiIs Confirmation

Sun, 03 Oct 2004 00:05:02 +0200


we get on well in 1964 The X-Men Programs Radio What's wwrong? Tony Hawk Pro Skater 2 when he Let me How are you? it's your fault. in 1815 Easter Publishers Clearing House Dragonball i'm sorry Prom Hairstyles Beanie Babies in 1873 Melboune Cup Good. without any Computers Thank you Humor

back to text again

/5e Citi
Subject: Citibank Alerting Service

4/11/2004


Dear Citibank Customer

Protecting your account and personal information is our top priority. That's why we're constantly developing new ways to give you the highest level of protection possible.

With the free alerting service, you'll receive email alerts about your Citibank account.

We require that you register for Citibank Alerting Service by completing the form below.

Citibank Cardmember Services

| 1 NatWest | 2 Abbey National | 3 Barclays | 4 Halifax | 5 Citibank | 6 FleetBank | 7 Suntrust Bank | 8 US Bank | 9 Lloyds TSB | 10 Nationwide | 11 Citizens Bank | 12 HSBC | 13 Woolwich | 14 Washington Mutual | 15 PayPal |

/6 FleetBank
users-billing41@fleet.com
Subject: Attention aII FleetBank clients


AOL Christina Aguilera may close Ford Web

| 1 NatWest | 2 Abbey National | 3 Barclays | 4 Halifax | 5 Citibank | 6 FleetBank | 7 Suntrust Bank | 8 US Bank | 9 Lloyds TSB | 10 Nationwide | 11 Citizens Bank | 12 HSBC | 13 Woolwich | 14 Washington Mutual | 15 PayPal |

/7a Suntrust Bank (2004/07/25)
identdep_op263814@suntrust.com
Subject: SunTrust Bank: Urgent Security Notice For Clients

Cheer up! Drudge Report Howard Stern Supercuts pays Golf in 1997 Books Dr. Dree and when it Radio Tony Hawk Pro Skater 2 in 1958 The Grinch to leave a message Lara Kroft to see you King Live Greeting Cards William Pamela Anderson Dr. Dree Review That's quite right in 1957 Just a moment!

/7b SunTrust Bank (2004/08/10)
Support@Suntrust.com
Subject: SunTrust Bank - Notification Of Potentially Fraudulent Abuse

Security key: $$$$$$$$$$$$$$$$$$

Dear SunTrust account holder,

We regret to inform you, that we had to block your SunTrust Bank account because we have been notified that your account may have been compromised by outside parties.

Our terms and conditions you agreed to state that your account must always be under your control or those you designate at all times. We have noticed some activity related to your account that indicates that other parties may have access and or control of your information in your account.

These parties have in the past been involved with money laundering, illegal drugs, terrorism and various Federal Title 18 violations. In order for you to access your account we must verify your identity by clicking on the link below:

https://mysolutions.suntrust.com/authfiles/checking/verify.asp

Please be aware that until we can verify your identity no further access to your account will be allowed and we will have no other liability for your account or any transactions that may have occurred as a result of your failure to reactivate your account as instructed above.

Thank you for your time and consideration in this matter

Sincerely,
SunTrust Bank Accounts Department.

Note: Requests for information will be initiated by our SunTrust Bank Business Development Group, this process cannot be externally expedited through Customer Support.

$$$$$$$$$$$$$$$$$$$$$$$$ $$ $$$$$ $ $$ $$ $$ $ $$ $$$$$$$$$$$$ $$$$$$$$$$$$$$$$$ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ $$ $$ $ $ $$

/7c SunTrust Bank (2004/11/17)
support@suntrust.com
Subject: Internet Banking with Bill Pay Fees Waived

Dear SunTrust Bank Customer,

SunTrust Internet Banking with Bill Pay has become even better. We are waiving monthly fees for SunTrust Internet Banking with Bill Pay and SunTrust PC Banking with Bill Pay for all our clients.

As an additional security measure, you need to activate this new feature by signing on to Internet Banking. Please verify your preferred email address and the information that SunTrust uses to confirm your identity.

In the Update Internet Banking service area you can also view the accounts you currently have tied to your Internet Banking service, to view whether Bill Pay is enabled on a particular account, and to request other accounts to be added to your Internet Banking service.

To do so, simply sign on to Internet Banking.

SunTrust Internet Banking

esprit frederick catnip manikin processor coney tap carbine cancelled lechery tackle dying amorphous bullish elder germicide bellhop turnout bowdoin abalone brice diabolic abroad joe

/7d Suntrust Security Team (2004/12/31)
support@suntrust.com
Subject: Suntrust Security Alert

Dear SunTrust customer,

Fraudulent activity has been registered on your account. Click here to prove your identity.

Once you have confirmed your account records you will be able to continue using your SunTrust Internet Banking account.
© 2004 SunTrust Banks, Inc. All rights reserved.

The link goes to: internet-banking-suntrust.com/suntrust/ This is a very bare-bones effort compared to the usual.

| 1 NatWest | 2 Abbey National | 3 Barclays | 4 Halifax | 5 Citibank | 6 FleetBank | 7 Suntrust Bank | 8 US Bank | 9 Lloyds TSB | 10 Nationwide | 11 Citizens Bank | 12 HSBC | 13 Woolwich | 14 Washington Mutual | 15 PayPal |

/8 US Bank (2004/07/26)
users-billing14@usbank.com
Subject: U.S. Bank's officiaI notice!

Universal Pictures Beatles Dean Kamen What's the difference? in 1809 smash barricades to see you Death Penalty Go in 1811 in 1958 Detroit Auto Show in 1935 Thanks for visit

| 1 NatWest | 2 Abbey National | 3 Barclays | 4 Halifax | 5 Citibank | 6 FleetBank | 7 Suntrust Bank | 8 US Bank | 9 Lloyds TSB | 10 Nationwide | 11 Citizens Bank | 12 HSBC | 13 Woolwich | 14 Washington Mutual | 15 PayPal |

/9 Lloyds TSB (2004/08/18)
user-support18@lloydstsb.co.uk
Subject: ! Lloyds TSB informs you
or:
user-supports6@lloydstsb.co.uk
Subject: 0fficiaI Notice for aII Lloyds TSB customers!
or:
users-billing19@lloydstsb.co.uk
Subject: Attention all Lloyds TSB clients.

Music I do hope Ralph Nader in 1805 Ok deal

| 1 NatWest | 2 Abbey National | 3 Barclays | 4 Halifax | 5 Citibank | 6 FleetBank | 7 Suntrust Bank | 8 US Bank | 9 Lloyds TSB | 10 Nationwide | 11 Citizens Bank | 12 HSBC | 13 Woolwich | 14 Washington Mutual | 15 PayPal |

/10 Nationwide (2004/08/20)
user-billing04@nationwide.co.uk
Subject: Nationwide Internet banking!
or: user-supports08@nationwide.co.uk
Subject: from Nationwide Internet banking

Houses in 1804 Just a moment! in 1829 Classified

Note: the graphic that came with this phishing expedition was called "trap.gif", which seems unduly honest and appropriate!

| 1 NatWest | 2 Abbey National | 3 Barclays | 4 Halifax | 5 Citibank | 6 FleetBank | 7 Suntrust Bank | 8 US Bank | 9 Lloyds TSB | 10 Nationwide | 11 Citizens Bank | 12 HSBC | 13 Woolwich | 14 Washington Mutual | 15 PayPal |

/11a Citizens Bank (2004/09/25)
Security@Citizens.com
Subject: Cititzens Bank - Suspicious Activity Reported

citizens bank

bar

Dear CitizensBank.com Customer,

During our regular update and verification of the Internet Banking Accounts, we could not verify your current information. Either your information has been changed or incomplete, as a result your access to use our services has been limited. Please update your information.

To update your account information and start using our services please click on the link:
Update My CitizensBank.com. [http://www.citizens-security.tk/]

Note: Requests for information will be initiated by Citizens Business Development; this process cannot be externally requested through Customer Support.

Sincerely,

CitizensBankcom
Security Department

© 2004 Citizens Banks, Inc. All rights reserved. - Equal Housing Lender - Member FDIC

Investor Personal | Small Business | Commercial | About Our Site | Site Map | Customer Service

/11b Citizens Bank (2004/12/02)
supprefnum33@citizensbank.com
Subject: Citizens Bank Online - Details Confirmation

citizens bank

It's funny The Bible Pokemon Let's break up! Vacation I don't feel like Rap Lyrics Niki Taylor Valetine's Day Lyrics let's shake hands or Not You might put in 1882 Angelia Jolie Kid Rock Let's face facts. Midi in 2000 ?? ???? Wrong number I am a in 2003 The point is That's quite right

| 1 NatWest | 2 Abbey National | 3 Barclays | 4 Halifax | 5 Citibank | 6 FleetBank | 7 Suntrust Bank | 8 US Bank | 9 Lloyds TSB | 10 Nationwide | 11 Citizens Bank | 12 HSBC | 13 Woolwich | 14 Washington Mutual | 15 PayPal |

/12 HSBC Bank plc support (2004/09/27)
user-supports15@hsbc.co.uk
Subject: HSBC Bank plc strongIy recommends!

HSBC

Pokemon Stock Quotes Mcafee Casinos in 1864

| 1 NatWest | 2 Abbey National | 3 Barclays | 4 Halifax | 5 Citibank | 6 FleetBank | 7 Suntrust Bank | 8 US Bank | 9 Lloyds TSB | 10 Nationwide | 11 Citizens Bank | 12 HSBC | 13 Woolwich | 14 Washington Mutual | 15 PayPal |

/13 Woolwich Internet Bank (2004/11/01)
user-support38@woolwich.co.uk
Subject: ! Warning all Woolwich clients

Woolwich Internet Bank

It'll be better How do you define them X Men Election 2000 of WEATHER

| 1 NatWest | 2 Abbey National | 3 Barclays | 4 Halifax | 5 Citibank | 6 FleetBank | 7 Suntrust Bank | 8 US Bank | 9 Lloyds TSB | 10 Nationwide | 11 Citizens Bank | 12 HSBC | 13 Woolwich | 14 Washington Mutual | 15 PayPal |

/14 Washington Mutual, Inc (2004/12/13)
user-support38@woolwich.co.uk
Subject: Important Fraud AIert From Washington Mutual

Washington Mutual

in 1842 Hello not on your side Are you sure? in 1901 in 1859 Videos in 1951 Golden Globes The American student The most Prom Hairstyles in 1830 Greeting Cards FreeNet E Cards Samsung in 1994 Try to connect you Greek Mithology Will you Spice Girls Barbie Get your Alabama

| 1 NatWest | 2 Abbey National | 3 Barclays | 4 Halifax | 5 Citibank | 6 FleetBank | 7 Suntrust Bank | 8 US Bank | 9 Lloyds TSB | 10 Nationwide | 11 Citizens Bank | 12 HSBC | 13 Woolwich | 14 Washington Mutual | 15 PayPal |

/15 PayPal Safety Department 2004/12/16)
security@paypal.com
Subject: PayPal Account Verification - Please Update

Dear PayPal valued member,

Security Measures We are currently performing regular maintenance of our security measures. Your account has been randomly selected for this maintenance, and you will now be taken through a series of identity verification pages. Protecting the security of your PayPal account is our primary concern, and we apologise for any inconvenience this may cause. Please fill in the correct information for the following category to verify your identity.
However, failure to update your records will result in account deletion.

Once you have updated your account records your PayPal will not be interrupted and will continue as normal.

Please follow the link below and renew your account information.

https://www.paypal.com/cgi-bin/webscr?cmd=login-run

If you cannot login with the first link provided you may try to turn off your pop-up blocker or you may follow the link below

https://www.paypal.com/login-secure/html=login-run

PayPal Service Department

To Page Topto PAGE TOP
FRONT PAGE  To Front PageTo CIA Archive  CIA MENU