Nationwide Spam: We Detected Irregular Activity on Your Account

In the past few weeks, a large number of Nationwide phishing scams have been seen and, as it turns out, new versions keep popping up almost every day.

Here’s one discovered by millersmiles.co.uk:

Dear Nationwide Customer,

Please kindly click on the secure my internet banking access below to get your account and credit or debit card details secure from online fraud. SECURE MY NATIONWIDE INTERNET BANKING

GFI experts have also identified a couple of new variants. One refers to the validation of the recipient’s Internet banking profile and the second one claims that an “unusual conflict between the customer number and profile details associated with the account” have been identified.

All of these spam messages contain links that lead to various compromised websites that have been set up to host a cleverly designed phishing page.

The malicious webpage almost perfectly replicates the legitimate login page, attempting to trick customers into handing over their online banking usernames and passwords.

Internauts are advised to double check the URL that hides behind a link before clicking on it.

In the schemes presented here, nothing bad can happen to the user as long as he/she doesn’t input the credentials on the fake site. However, there are situations in which the links point to compromised websites which host malware that can seamlessly steal sensitive information.

On the other hand, webmasters are also recommended to regularly check their websites for any signs of malicious activities. Cybercriminals place their rogue webpages in hidden folders to ensure that they’re not easy to identify, but there are a number of clever tools that can make an administrator’s task much easier.

Here is one of them from McAfee.