Latest Scams

Tab Napping

Watch out for this new online phishing scam which uses 'tab napping' to attack your computer - and your finances...

As internet users we’re all vulnerable to online scams. Unluckily for us, as soon as we become pretty good as spotting one type of attack, another more sophisticated version comes along in its place. In fact, technology company Mozilla - which developed the Firefox web browser - has recently warned against a possible threat from a new scam known as ‘tap napping’ which takes phishing one step further. 

What is tab napping?

Tab napping is essentially a new kind of phishing scam. Until now phishing has involved sending hoax emails in an attempt to steal your usernames, passwords and bank details. Often the sender will claim to be from your bank and will ask you to verify your bank details by clicking on a link contained in the email.

The link actually directs you to a fake website which looks just like your bank's own website. Once you have typed in your login details they can be accessed by the criminals who set the fake site up.

But we’re beginning to wise up to phishing attacks like this, and many of us know we should be very wary of clicking URLs even if they appear to be in a legitimate email.

With awareness of phishing on the up, making it more difficult for scammers to succeed, tab napping could be the scam to watch out for next.

How does tab napping work?

Tab napping is more sophisticated than the phishing scams we’ve seen so far, and it no longer relies on persuading you to click on a dodgy link. Instead it targets internet users who open lots of tabs on their browser at the same time (for example, by pressing CTRL + T).

How does it work? By replacing an inactive browser tab with a fake page set up specifically to obtain your personal data - without you even realising it has happened.

Believe it or not, fraudsters can actually detect when a tab has been left inactive for a while, and spy on your browser history to find out which websites you regularly visit, and therefore which pages to fake.

So don't assume that after you have opened a new tab and visited a web page, that web page will stay the same even if you don’t return to it for a time while you use other windows and tabs. Malicious code can replace the web page you opened with a fake version which looks virtually identical to the legitimate page you originally visited.

How might tab napping work in practice?

Imagine you open the login page for your online bank account, but then you open a new tab to visit another website for a few minutes, leaving the first tab unattended. When you return to your bank’s site the login page looks exactly how you left it. What you haven’t realised is that a fake page has taken its place, so when you type in your username and password, you have inadvertently given the fraudster easy access to your account.

Even if you have already logged into your bank account before opening another tab, when you return you might find you’re being asked to login again. This may not necessarily rouse any suspicion since you might simply assume your bank has logged you out because you left your account inactive for too long. You probably won’t even think twice before logging in for a second time. But this time round you have accidently inputted your security details into a fraudster’s fake page which have been sent back to their server.

Once you have done so, you can then be easily redirected to your bank’s genuine website since you never actually logged out in the first place, giving you the impression that all is well.

How can you protect yourself against tab napping?

This is pretty scary stuff but thankfully tab napping should be relatively easy to avoid. Here are five simple ways you can prevent yourself from falling victim:

• Make sure you always check the URL in the browser address page is correct before you enter any login details. A fake tabbed page will have a different URL to the website you think you’re using.
• Always check the URL has a secure https:// address even if you don’t have tabs open on the browser.
• If the URL looks suspicious in any way, close the tab and reopen it by entering the correct URL again.
• Avoid leaving tabs open which require you to type in secure login details. Don't open any tabs while doing online banking - open new windows instead (CTL + N).
• Finally, take a look at Online banking: How to stay safe to find out other ways to protect yourself from online scams.

Land line scam
We have been made aware of a scam involving users of BT telephone landlines
A woman using a mobile phone A woman using a mobile phone

The victim is called and told that their bank has withheld a direct debit payment to BT and that the account was now in arrears. Unless a payment is made now over the phone by credit card, then the phone line will be cut off. If the victim is dubious about the situation, the caller tells the victim that to demonstrate that the call is genuine, the line will be cut off for a few minuets. The line goes dead and the caller is then unable to get a dialling tone. The suspect then rings back to demonstrate that the phone line can be cut off and reinstated at will.

The victim is then encouraged to hand over the details of their credit card in order to pay the outstanding account and have the phone line reinstated. The card details are then used to withdraw cash on the victims credit card account.

A couple of things come to mind here.

The suspect obviously has knowledge of the account details of the victim. Possibly he has worked for BT, or a call centre that has knowledge of BT accounts.

The suspect gives the impression that he can cut off the landline connection. All that he does in fact is to stay on the line and keep quite. This has the effect of locking the line to the suspects phone. When the victim puts the phone down and picks it up again, because it is still locked to the suspect, there will no dialling tone. This gives the impression that the line has been disconnected.

BT are aware of the situation and are investigating.
Source Merseyside Police

Vishing Scam

By now most people have heard of phishing the scam where you receive a convincing-looking e-mail asking you to verify account information with Paypal or a bank. But when you click the link on the mail, you’re sent to a fake (but equally convincing) web site where the details you enter become the property of the scammer and you can easily find yourself the victim of identity theft.

Phishing still happens, and people still fall victim to it, unfortunately. But more and more people have become wise to the trick, so the criminals have come up with a new wrinkle. Instead of sending you a link in an e-mail, they ask you to call a phone number. It’s phishing by voice, which people have dubbed vishing.

How It Works

However, there have also been instances of cold calling, where you pick up the phone and receive an automated message saying there’s a problem with your account, and prompting you to enter your details.

The problem comes when you respond to either the e-mail or the phone message. You’re taken into an automated voice system that claims to belong to the bank or whoever you’re dealing with and that seems as official as anything a proper institution would use, and prompted for all the details on your account. At the end you’re thanked and disconnected. The first you know that you’ve been scammed is when money begins vanishing from your account (or extra charges appear on your account).

There have been instances in America of people receiving calls from real people to try and achieve the ads, usually claiming to be from a phone company, and offering a special discount. All they needed was some information – although, according to utility spokespeople, no one responded.

How to Avoid the Scam

Never assume something is legitimate. Even if you receive a call from a person, call them back on the number you have for your bank. Even if the calls seems to originate from a probable code – 0207, for instance – don’t believe it. With VOIP (Voice over IP), you can get a number anywhere in the world; it means nothing, and setting up an automated response system can prove to be well worth the expense.

We’ve become educated enough to doubt links in e-mails. But we still tend to accept that a phone number must make everything real. To stop being scammed, you have to be more cynical and never take anything at face value. Call the bank or institution to check on the mail, but use the number from your card or statement.

Simply put, don’t believe a word and you’ll be much safer.

Tax Refund Scam

A new variation of the standard 'phishing' scam is currently doing the rounds. An email purporting to be from HM Revenue and Customs informs recipients that they are eligible for a substantial tax refund. All they have to do is send all their personal details on an attached form. Our usual advice applies: Never respond to  emails of this kind.

Belize Email Scam

Every year it seems in the approach to Christmas an email is circulated warning about a 'new' scam. It usually says that a card is posted through your door from a parcel delivery service to say that they were unable to deliver a parcel and that you need to call them. If you call the number and you start to hear a recorded message you will already have been billed £15 for the phone call.

This is not a new scam. The chain email refers to a service that was shut down in December 2005. The company that was operating the service was fined £10,000. The service is no longer running and has not been running since December 2005.

The email refers to a £15 charge for simply being connected to a recorded message. This is not true - a £15 connection charge does not exist. The service in question actually cost £1.50 per minute and lasted six minutes, making a total cost of £9 if callers stayed on the line for the full six minutes.

Please do not contact us about this service as it was stopped almost three years ago. If you receive a copy of the email warning you about the alleged scam, please do not forward it to others.

Looking for a childminder

We have been informed of a new scam aimed at childminders. In emails we have been told about the name of the sender is different but the text is virtually identical.

The email starts with the text: My name is Harry Rosario and I am Italian American. At present I am looking for a minder for my 3year old son who would be moving to the UK with me. I would like to know if you can offer your services. I would like to know 1. your location 2. fees. I would be happy to ask my client to post a certified UK cheque to you in advance for deposit and booking of your services.

One person who responded received a photo of a young child. We would expect the next step would be for an overpaying cheque to be received with a request to forward the difference to a third party.

UK Advance Fee Fraud

Traditionally associated with Nigeria, the advance fee fraud has been doing the rounds for a number of years. Now a number of Gloucestershire residents have reported receiving an email from an 'external auditor of a well known bank here in the United Kingdom' offering to share the secret account of a multi millionaire who has died in a plane crash leaving no next of kin.

National Lottery Winning Notification

An email originating in Canada tells you you've won thousands on the national lottery online. You are asked to fill in your details and send them to their UK claim agent.

Sounds a bit phishy to us. This is the first time we've seen the UK lottery used in this kind of scam. Never respond to these emails, any response is likely to be followed by a request for more information and an 'administration fee' to release your 'winnings'.

Maître Norbu

Another direct mailing, this time from Switzerland. 'Maître Norbu and his student Sonam' prey on the vulnerable by promising to cure their difficulties with their 'red alert rescue plan'. In return for their amazing free gifts all you have to do is send a 'modest contribution' of £25 towards costs.

Don't reply to these mailings - destroy them without responding.

Stop junk mail by registering with the Mailing Preference Service.

Paper Roll Logistics

The actions of a Canadian-based company called Paper Roll Logistics have recently been brought to our attention. The company allegedly cold call traders asking only for a name or confirmation of the company address. The trader then receives a box of till or credit card machine rolls with an invoice for £200 or more (10 times the normal cost), followed by numerous demands for payment

Demanding payment for goods known to be unsolicited is an offence under the provisions of the unsolicited Goods and Services Act 1971. The Office of Fair Trading is currently investigating the matter.

European Health Insurance Card

We have received complaints concerning an internet company charging £15.00 for these cards. In fact they are available free of charge from the Department of Health.

Spanish Lottery Primitiva

We have received complaints from people receiving personally addressed letters, bearing a Malaga or Madrid postmark, claiming they have won the Spanish lottery. In order to claim their ‘prize’ recipients are asked to complete a claim form requiring detailed personal information and agreeing to pay 10% of the 'winnings' to an agent.

Samantha

Several Gloucestershire residents have reported receiving a letter posted in Austria from 'Samantha' who claims to be a medium, an astrologer of international standing, and an expert in dreams' interpretation!

In the letter Samantha predicts a dire outcome for you unless you tear the enclosed Jack of Spades playing card into four pieces and post it back to her with a 'modest donation' of £10.

This is a common direct mail scam. Don't reply to these mailings - destroy them without responding. If you send money you are likely to be bombarded with further scams, because your name will be added to a 'sucker' list.

Stop junk mail by registering with the Mailing Preference Service.

Unwanted Clothing Collection

Householders receive a leaflet or a bag through the door asking for donations of clothing and linen. The leaflet usually state that any items will be carefully sorted and sent to the Third World. The small print explains that the company is a commercial organisation and not a charity.

Collections of this kind deprive genuine charities of significant sources of revenue and our advice to people who want to ensure their donations will go to worthy causes is to make contact with a local charity shop; or use collection bags distributed by genuine charities. Genuine charity collection bags should make clear reference to the charity registration number. You can check with the Charities Commission helpline on 0870 333 0123, or via the Charities Commission website, to ensure the charity is properly registered.

Women Empowering Women

This is a pyramid scheme run ‘by women for women only, no men allowed’ which attracts investors with talk of a 'gifting circle', 'universal understanding of our birthright' and 'fields of abundance'. In reality it encourages new recruits into handing over £3,000 to one of their friends who is already a member in return for a heart-shaped token. All women who do so are told they can expect a £24,000 return.

Those at the very top of the pyramid do indeed make money, but only out of someone else's loss. Eventually there are not enough people to take part and those just beyond the top levels all end up losing their money.

This practice is not actually illegal under current UK law so we can only advise people to stay away from the scheme. 

Chase Online Banking

Unsolicited emails tell recipients that other computers have logged onto their user profile accounts, and tried to log on using various different passwords. To avoid having their accounts suspended recipients are told they must change their passwords by clicking on a link provided.

This has all the hallmarks of a 'phishing' fraud and anyone receiving this email is advised to delete it.

Bella the Magician

An unsolicited letter tells you that Bella has performed a 'luck-and-fortune ritual' on your behalf which will ensure you receive large sums of money. All you have to do is send a donation of £17. Our advice is DON'T - it sounds like an advance fee scam. 

European Bureau of Prize Draw Registry

An impressive looking letter tells you that you've 'lucked out' and won over £2 million in a prize draw. Just send an initial £20 'procedural fee' to secure your payout. Again our advice is don't send any money - it sounds like an advance fee scam.

Bogus Invoice for Directory Entry

Businesses in Gloucestershire have received a notice which looks like a demand for payment for an unsolicited directory entry. The notice asks for £423 and confirms the name of the business and a classification under which the directory entry will appear. The small print at the bottom of the page states “this is not a bill”. 

Businesses receiving this notice are concerned that it looks like a bill requiring payment with a prominent request to “please remit this amount”. Our advice is to check all small print carefully, and warn your accounts staff to be on the look out for unsolicited invoices, particularly if you have temporary staff on duty.