Scam warning: Santander security email

Well, the Santander “Latest fraud updates” has a whole 2 articles, one on fake TV licensing emails, and one congratulating themselves for signing up to a push payment scam code, so I wouldn’t hold your breath waiting for a reply.

The Financial Ombudsman needs to bang some heads together to get the big banks to comply with a common security framework, so customers see some consistency between online bank security and aren’t exposed to the lamentable, ramshackle and dated security practises of some of the banks.

This should start with common 2 factor authentication using our chip and PIN cards and a generic card reader for all banks; I’m pretty sure a single card reader will read all VISA based cards at the very least. The bank could allow the customer to enroll the reader (if necessary) on their systems via a simple challenge/response process.

The problem is they spend too much time working out how to blame their customers for the flawed service they provide, or fleecing them in some other way. If it doesn’t affect the bottom line, they’re not interested.

If you bank with Santander and actually take the trouble to read the information they send you on every email, it says:

“Please do not reply to this email. It has been sent from an email address that does not accept incoming emails. Santander will never ask you to supply personal information such as passwords or other security information via email. As an additional security measure, every customer email will be addressed to you personally.”

Now go back and look at the scam email. It says: “Dear Customer”.

So let’s take a bit of personal responsibility for keeping our money safe, before we start finger pointing.

I’ve gone beyond the basics and can usually spot a scam email straight away, because I always allocate a different email address for every commercial relationship I enter into. Not only does this protect my “real” email address from spam, but if I receive a Santander email that is not addressed to santander@[mydomain].co.uk, it is a fake for sure. An email redirect service like this can be as cheap as £5 per year, so why don’t more people do it?

Had at least half a dozen Santander emails in the past couple of months. Each one addressed to me by name quoting part of my post code in an attempt to confirm their authenticity.
Only thing is, I am not, and never have been, a Santander customer.
Each of these emails looks completely genuine apart from the fact that they all contain a link to what I can only assume is a form designed to obtain additional information such as phone numbers, account numbers etc. which Santander say they will never include in an email. In fact all these emails actually include in the small print at the bottom a statement saying exactly that, that they will never include a link to obtain personal information.