A convincing phishing campaign is targeting customers of Lloyds Bank, Infosecurity Magazine reports. Law practice Griffin Law warns that more than 100 people have reported receiving emails that purport to come from Lloyds informing them of a suspicious login. The emails appear legitimate and display Lloyds branding, but they contain typos and awkward grammar.
The email subject line says, “Alert: Document Report – We noted about security maintenance.” The email itself states, “Your Account Banking has been disabled, due to recent activities on your account, we placed a temporary suspension until you verify your account.”
The emails contain a link to a realistic-looking phishing site at Lloyds[.]bank[.]unusual-login[.]com, which asks the user to log in to their Lloyds account and enter their financial information.
The scammers are also sending text messages with links to the same phishing site. The texts read, “ALERT FROM LLOYDS: New device attempted to set up a payee to XXX. If this was NOT you, visit: Lloyds[.]bank[.]unusual-login[.]com.”
Chris Ross, Senior Vice President at Barracuda Networks, commented to Infosecurity Magazine that people need to be particularly vigilant for phishing scams that go after banking information.
“Hackers often hijack the branding of legitimate companies in order to steal confidential financial data from unsuspecting victims,” Ross said. “These scams can be very convincing, making use of official logos, wording and personalised details to lull the individual into a false sense of security. In most cases, the victim will be directed to a fraudulent but realistic looking website, where they are urged to enter account details, passwords, security codes and PIN numbers. Phishing attacks like this pose a huge risk both to individuals and the companies they work for, especially if hackers gain access to a business bank account. Tackling this problem requires robust policies and procedures as well as the latest email security systems in place to identify and block these scams before they reach the inbox.”
New-school security awareness training can help your employees recognize and thwart both unrefined and sophisticated social engineering tactics.
Infosecurity Magazine has the story.
