Natwest Online Banking - now a pain to log in

Efour · 30 Jul 2010 at 01:22

http://www.e4.com/fonejacker/soundboard-george.html

if you get this guy hang up asap

Wicksta · 30 Jul 2010 at 01:23

I would give them a call, there is no need for them to know the full card number in order (and especially CCV) to enter your online banking. It definitely sounds dodgy.

Sorry for loling earlier as well.

tom_e · 30 Jul 2010 at 01:24

That definately looks very very dodgy, they say they will never ask for your full password and/or pin and the way they want it entered makes it look like itl be read by a human

meghatronic · 30 Jul 2010 at 01:25

benftl said:
Nope, I'm now certain it's a scam.

[ig]http://img408.imageshack.us/img408/131/phish.jpg[/img]

WTF?

"Password and Pin -like that: Password--PIN".... text field for dates....

Call them asap.

qqg3 · 30 Jul 2010 at 01:25

Just checked mine, no change, just the usual 3 sets of info.

Edit; Looks like a scam from your image. Esp. that "Password - PIN" part

ElectroBlaster · 30 Jul 2010 at 01:28

I have been into my account twice tonight and everything was as normal, wasnt asked for a full card number just the usual digits from my online pin and password etc.

I would say the scammers are about and getting a lot better at their rubbish!

Wicksta · 30 Jul 2010 at 01:28

'ATM' isn't a phrase you'd see used by a bank over here to log in like that. Definitely dodgy.

Aod · 30 Jul 2010 at 01:32

meghatronic said:
Call them asap.

steps to check:
install and use a new browser, preferably Chrome.
go to http://www.natwest.com in chrome
go to the online banking login page (like you posted in the screenshot) and click the lock-logo in the address bar, which will allow you to see the security certificate details, and compare them to this:

specifically the Serial number

benftl · 30 Jul 2010 at 01:32

Online Banking details changed, card cancelled, hopefully I've escaped any actual damage this time.

I feel like such a fool, it's obvious now that the details they were asking for were wholly inappropriate, but I'm still at such a loss as to how the URL appears legitimate when clearly I'm being directed to somewhere else? In fact I'm incredibly annoyed that the software apps I have installed haven't detected anything dodgy.

What do you guys think?

Bony Maloney · 30 Jul 2010 at 01:35

Same old login for Natwest here. Ring the bank, you've been scammed me thinks.

EDIT: Good chap, close call.

Felix Da Housecat · 30 Jul 2010 at 01:36

How come you went to a fake site and not to the genuine one? Did you follow a link in an email or something?

tntcoder · 30 Jul 2010 at 01:37

benftl said:
Online Banking details changed, card cancelled, hopefully I've escaped any actual damage this time.

I feel like such a fool, it's obvious now that the details they were asking for were wholly inappropriate, but I'm still at such a loss as to how the URL appears legitimate when clearly I'm being directed to somewhere else? In fact I'm incredibly annoyed that the software apps I have installed haven't detected anything dodgy.

What do you guys think?

How did it happen? If you clicked on a link to get to the Natwest login page then that's fair play and your fault. If however you manually navigated to the site and it still happened then it could be one of hundreds of possible attacks and basically as it's financial related don't take any chances and reinstall your OS from a trusted CD/DVD. No point in messing around.

benftl · 30 Jul 2010 at 01:37

No, I went through Natwest.com as usual. This is what's so confusing, check the image I posted earlier, the URL looks entirely legitimate.

tntcoder · 30 Jul 2010 at 01:39

benftl said:
No, I went through Natwest.com as usual. This is what's so confusing, check the image I posted earlier, the URL looks entirely legitimate.

Then your OS, browser or LAN is compromised. That image definitely doesn't look legit to me.

Aod · 30 Jul 2010 at 01:41

tntcoder said:
Then your OS, browser or LAN is compromised. That image definitely doesn't look legit to me.

Agreed, benftl, do you have WiFi or ethernet only? if it's WiFi, are you using WEP or WPA?

either way, it'd be a good idea to change your WiFi password too

benftl · 30 Jul 2010 at 01:42

Indeed, we've established it's illegitimate. What worries me is that should the questions have been phrased in a proper manner, I wouldn't have been concerned one bit as there was no other indication that the site was compromised in any way.

I'll get the cert details posted up shortly for the member who wanted them!

[edit]WiFi and Ethernet, however I'm assured my LAN isn't compromised as I use WPA2 encryption and a stupidly long password on both laptops. I can only assume both computers have become infected somehow.

benftl · 30 Jul 2010 at 01:51

Here we are, for those interested:

tntcoder · 30 Jul 2010 at 01:56

Yer the cert is fine.

It's most likely a browser or possibly OS rootkit modifying what you see, or some other clever piece of Malware.

Format -> Reinstall

benftl · 30 Jul 2010 at 02:02

I know what you're saying, the problem is not only would a format and reinstall be a HUGE pain in the arse but also if I don't know what has caused this infection then what's to stop it happening again?

I'd rather know what the problem is than start from scratch and hope for the best. Clearly Spyware Doctor isn't worth the subscription fee, the scan is almost complete and nothing has been found.

decmatt · 30 Jul 2010 at 02:05

You could try MalwareBytes, but if its a well done rootkit, this won't detect it. A complete format and reinstall would be needed.