A friend sent me this link, which is an interesting spin on the old “HMRC tax refund” scam – a fake HMRC claiming your bank wants to issue a refund instead.

Click to Enlarge

As you can see below, they have a large selection of banks to choose from (in keeping with more common phish attacks):

Click to Enlarge

Everybody from NatWest and HSBC to Santander and Halifax are in there. Most of the bank specific pages all ask for the same kind of personal information, but if one of the banks asks for something unique to them (such as a banking PIN or other security feature) the phishers have taken care to include those too. If your bank isn’t included, no problem: they have a generic “catch-all” page for you to sign up to years of identity theft and a couple of days worth of “Who bought all this stuff on iTunes”?

Here’s a sample of the information asked for on the Barclays page:

Click to Enlarge

Deep breath: name, address, phone number, email (and email password!), national insurance number, information related to your parents, how long you’ve lived at your address, employment status / income, your full card details (of course) and everything related to your online banking account.

I think “Ouch” is the word we’re looking for.

HMRC do not issue tax refunds by email, they most certainly do not have websites where banks want to issue you with refunds, and they also know how to spell “being” (take another look at that second screenshot).

Avoid like the plague.

Christopher Boyd

• Filing Deadline Extension Triggers More Fake Offers of Tax Refunds
  The Central Board of Direct Taxes of India extended the deadline for filing income tax for fy11 from September 30, 2010, to October 15, 2010, in view of difficulties caused by the recent floods in var...
• Randomization of code and binaries used by a fake antivirus website
  Last week, I talked about heavy obfuscation being used by attackers to hide their HTML source code from detection. This time we came across an interesting fake antivirus website, which not only contin...
• Phishing Attack Uses Fake Donation Website
  Earlier today, we found a phishing site that poses as a donation site to raise money for the victims of the recent earthquake in Japan. The phishing site http://www.japan{BLOCKED}.com is created by us...
• Compromised website used in Bank of America phish
  In malware analysis, it is quite common to come across attacks that you quite simply cannot believe could really work. I quite often find myself asking the question how anyone could actually fall vic...
• Australian job hunters offered money laundering jobs via fake seek.com.au website
  Today, SophosLabs witnessed a new job spam campaign targeting Australians. The email message claims to provide part-time jobs with excellent pay. The interesting part of this spam campaign is that th...
• Fake Bank of America survey harvests your credentials
  You may have received the following email recently (click to enlarge): Some of the text reads: “Recently you received an e-mail inviting you to participate in a Web-based survey from Bank of Ame...
• Fraudulent Gaming Sites Providing Fake FIFA Offers
  In the past month, several phishing websites were observed to be spoofing online gaming brands. The popularity of the FIFA World Cup has encouraged users to visit legitimate gaming sites to play onlin...
• Malicious Spam on the increase again
  Malware distribution via email is far from dead.  While we had a distinctly quiet period from October 2010 to March 2011, our stats show the bot herders are gearing up again with the proportion o...
• The Royal Wedding and The Fake Antivirus
  The Royal Wedding of Prince William and Catherine Middleton that will be held tomorrow, on April 29, will attract the attention of many people around the world, and has become a trending topic on vari...
• Fake AV for mobile platform
  We have seen countless number of rogue security products for Windows platform however this one is targeted to trick mobile users.The sample masquerades itself as a certain AV for mobile and ...