[email protected]

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Tue Oct 09, 2012 8:36 pm

A form was attached to the email to make it look like a bank site. no address or anything.

Subject: New Update
From: "[email protected]" <[email protected]>
Date: Sun, October 7, 2012 7:56 am
Cc: recipient list not shown:;

Dear Halifax bank Customer,

It has come to our attention that your Halifax online account® information needs to
be updated
as part of our continuing commitment to protect your account and to reduce the
instance of fraud on our
card account.

If you could please take 5-10 minutes out of your online experience and update your
personal records you
will not run into any future problems with the online service.

However, failure to update your records will result in account suspension. Please
update your records before
October 15, 2012.

Once you have updated your account records, your Halifax card® account activity
will not be interrupted and will continue as normal.

To complete this process download the attachement and follow the instruction.
Please understand that this is a security measure intended to help protect you and
your card.

Regards

Halifax Bank Of Scotland | Security team

Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: (qmail 9553 invoked from network); 9 Oct 2012 20:31:43 -0000
Received: from mx1.potsdam.edu ([137.143.110.103])
(envelope-sender <[email protected]>)
by hermes.potsdam.edu (qmail-ldap-1.03) with SMTP
for <[email protected]>; 9 Oct 2012 20:31:43 -0000
Received: (qmail 19475 invoked from network); 9 Oct 2012 20:31:43 -0000
Received: from bearmail.potsdam.edu (HELO maia) (137.143.104.65)
by mx1.potsdam.edu with SMTP; 9 Oct 2012 20:31:43 -0000
Received: (qmail 9829 invoked from network); 7 Oct 2012 17:49:24 -0000
Received: (ofmipd 127.0.0.1); 7 Oct 2012 17:49:02 -0000
Received: (qmail 9824 invoked from network); 7 Oct 2012 13:49:22 -0400
Received: from mail.qvs.co.nz (HELO qvs.co.nz) (125.236.241.199)
by mx2.potsdam.edu with SMTP; 7 Oct 2012 13:49:22 -0400
Received: from User ([63.227.129.47]) by qvs.co.nz with Microsoft SMTPSVC(6.0.3790.4675);
Mon, 8 Oct 2012 00:56:26 +1300
Date: 7 Oct 2012 05:56:26 -0600
Message-ID: <[email protected]>
From: "[email protected]" <[email protected]>
Reply-To: [email protected]
Cc: recipient list not shown: ;
Subject: New Update
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_011D_01C2A9A6.11124F7E"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X-OriginalArrivalTime: 07 Oct 2012 11:56:26.0418 (UTC) FILETIME=[C78C5920:01CDA482]

This is a multi-part message in MIME format.

------=_NextPart_000_011D_01C2A9A6.11124F7E
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit

------=_NextPart_000_011D_01C2A9A6.11124F7E
Content-Type: application/octet-stream;
name="Secure_update.html"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="Secure_update.html"

Posted: Tue Oct 09, 2012 9:02 pm

Looks to be a standard phishing website and not something we deal with here.

Posted: Wed Oct 10, 2012 9:14 pm

Marking 'n/a' for a move