Bank phishing scams - Bank of America, Citibank

What is bank phishing?

Bank phishing is a technique via which fraudsters try to gather your bank account details using seemingly legitimate emails and web sites. The attack starts with a scam email that is meant to distress and upset you with subjects like "You account has been hacked", "Account has been blocked", "Discrepancy in the account information", "Change password" etc. these emails carry a link to a fraudulent web site that looks like the actual web site of your bank and would typically carry a login form.

This article provides details on how to identify a bank phishing email and advises you on what to do. Any logos displayed on this page are copyright of the corresponding company and are a part of the phishing emails that I have received. They have been shown here only for the purpose of educating the gullible, informing them of the potential danger of phishing attacks.

What can happen if your bank login details fall into the wrong hands?

You don't need to be a rocket scientist to understand loses incurred if the bank login information is shared with frauds. Not only will you lose money - funds can be transferred to bank accounts across the globe in a matter of a few minutes/hours - but you can also end up losing your credibility. Several banks have struck down hard at phishing thugs but mails still seem to come through.

How to detect a bank phishing email?

Though a bank phishing email might look like one coming from a legitimate source, it will always have some loopholes by which you can easily detect the scam. The first is that it would typically not be addressed to you (with your name). Secondly, it might be badly formatted and not carry the bank's logo/colors. Thirdly, the URL of the links in the email might not point to the bank web site. Let us look at some examples.

Example #1 of a phishing email from a bank

Even the most gullible would detect this email phishing scam supposedly from Citibank as a fraud. the logo of the bank is missing and the formatting is messed up. The email does not carry the name of the recipient (just Dear Citibank Internet Banking Customer) and the URL displayed points to an I.P. address and not the actual Citibank web site. However, the words Citibank do figure in the URL.

Example #2 of a bank phishing email

This is a badly formatted email though it does carry a logo and can easily be recognized as a phishing attack. Also note the URL (web address) displayed on the status bar of Outlook Express which does not indicate that the email is from the bank's web site.

Example #3

A much better looking email - in fact it looks almost like the real thing. Two loopholes; it is not addressed to any one and the URL is again a giveaway. However, the URL does have the web site of the bank somewhere in the middle. This is a very smart phishing email.

How to protect yourself from the bank phishing attacks?

The most important advice that I can render is not to act rashly. Look at the email closely and even if you do want to put your fears at rest, go to the bank's web site by opening a fresh browser window instead of clicking a link from an email. Thus,

• Do not open web sites by clicking on a link in an email message
• Check the URLs or web site address which will be displayed in the status bar of the email program (Outlook Express, for example)
• Look for loopholes that I have mentioned above
• Download and install the free anti-phishing toolbar from Netcraft that works on a community effort to fish out spoof web sites.
• Report any phishing attack to your bank