July 22, 2008 -- (WEB HOST INDUSTRY REVIEW) -- Internet intelligence firm Envisional (envisional.com) has warned online banking customers about a new Vegas-themed phishing fraud that dupes them into revealing credit card information through fraudulent emails.
The criminals behind the attacks claim to be from Visa, Mastercard and American Express and offer email recipients the chance to win $100,000 or an all-inclusive Las Vegas holiday package.
Most phishing attacks come in the form of spam emails addressed to customers of a particular bank and manage to trick a few dozen victims.
However, this new tactic threatens more victims, because it uses a single email to target online account holders with any one of 12 major banks, and appears to be more legitimate in that it allows the victim to personally select the right bank from a drop-down list.
Envisional analysts say the latest email appears to be from an online travel website, with photos and write-ups depicting grand Las Vegas hotels.
The email offers a $100,000 personal credit card or the chance to win ten days in a top hotel, plus up to $30,000 spending money, to those who sign up for a new "Casino Rewards" program, supposedly run by Visa, MasterCard and Amex and sponsored by 12 large US and international banks.
Those who click through to the website that offers further information are invited to choose their bank from a drop-down list, making the suspectible to phishing attacks. One further click takes them to a fraudulent web page that mimics the log-in page of the bank in question, with the username in one slot and password in the other.
"Many more people will be taken in by this two-stage approach, in which the victim is initially reassured by the familiar credit card logos and then goes on to choose for himself from the list of banks," says David Franklin at Envisional. "With more banks in the frame and more account holders being tricked, we can expect to see many hundreds of victims, mostly in the US, but also among UK and European customers of banks like Capital One, Citibank, MBNA and Wells Fargo. Total losses could easily be over $1 million."
Envisional is part of the London listed Group NBT, alongside Internet companies such as NetBenefit and NetNames, which published its Quarterly Fraud Report in March, revealing that banking customers continue to face increasing levels of online fraud.
