ABSA Bank Security Update Center phishing scam

[Dave A]

This is one of the scariest phishing scams I've seen yet. Thank goodness the grammar is so shocking (and that I don't actually have an ABSA account), but there are a number of reasons this phishing attempt is particularly impressive.

Dear value Customer,a program as been developed in other to verify the existence of your account with us.
In the cause of this process we developed an online security banking system (SentryBay) to protect your account.
We require you to bear with us online for few minutes and follow the instructions as we will be sending you some sms for the verification purpose and it will be require in other to complete the Activation Program.

Do find an Encryption attachement below and download to begin the program.
================================
NB: Please do not reply to this email directly.
To ensure a prompt and secure response, SIGN ON to email us.
Absa Privacy and Security Department
Copyright (c) 2011
NB:Please do find your download Encryption on your computer inside downloads folder by extreme left on top corner under favorites.

The email comes with an HTML attachment, which is where the mischief really starts to get scary.

Then there's the preparation for the one time password SMS which you need to feed back to them.

And finally, when I go digging into the properties of the email to track back the real sender, the forged portion of the header detail is absolutely brilliantly done. You could easily mistake the actual routing section was just an intermediary.

[kahoel117]

the crooks is getting too clever

i'm at absa and what i do is put any email from any bank on my spam list. all banks is being targeted anyways.

snail mail is always the best ...

[mother]

I have been getting SO many phishing e-mails lately, I want to scream! I'm not kidding you, at least 4 or 5 per day! I block the senders as soon as I receive one, but of course there are always new crooks (or the same crooks with different addresses). I tell you, I SO badly want to reply to one of these mails, and tell them:

"F%#^$k you! Do you think I'm a f&^$*king moron? You f%$^king a%^$hole! Stop pestering me, or I will f^&%$king hunt you down and f%$%king kill you!"

But I don't.

Is there any way one can really BLOCK a sender, so the mail they send will bounce back to them, instead of just going to my Junkmail folder?

[Dave A]

Is there any way one can really BLOCK a sender, so the mail they send will bounce back to them, instead of just going to my Junkmail folder?

That's part of what stunned me with this one - it didn't get picked for junkmail status because of the authority of the sending route, and it pressed all the right "traceability" buttons. I'm trying to figure out if a good site got hacked or something, but this one had all the right stuff to maximise the chances of deliverability.

The wording may be a bit dodge, but on a technical level the email was superb. Not only was it without all the hidden technical gremlins that normally make a phishing email easy to spot if you know where to look, it actually had credibility builders and genuine source verifiers in there.

[geraldenek]

Thank goodness the grammar is so shocking.

Shocking....the least they can do is make sure their grammar and spelling is correct....

[kahoel117]

the banks know where the spam email comes from (source). cant they contact the relevant isp's to sort out the problem ?

[Justloadit]

the banks know where the spam email comes from (source). cant they contact the relevant isp's to sort out the problem ?

Not really, because they change the source on every batch of spam. One reason for trying very hard to do spoofing is to fool the systems from where the email originates.

[Sparks]

The one I received was not even on a ABSA letterhead.

When I checked the source to find the IP it actually said that it had originated from my own IP!!!