Can you tell if an email is genuinely from your bank?

What’s even worse is being contacted by a bank with a request to call them urgently, phone them up to find out the reason, and then not be able to answer their security questions (I almost never contact my banks by phone). Nationwide did this to me, and then blocked access to my accounts as a result – remember, they asked me to ring them, they didn’t say why, and I was unprepared for the third degree. What was unforgivable was that the original call was from their marketing department! So not only did I waste my own time calling them so they could try to sell me something I neither asked for nor needed, I ended up considerably inconvenienced. Needless to say, I no longer bank with them.

As for phishing emails, I always check the sender’s email address and the URL, and I never click through on anything financially related or anything I don’t recognise. I agree that it is good practice for senders to include something in their emails that is personal to you. Also, Santander include an image and phrase on their login screens chosen by the customer.

Some phishing emails are laughable, for example, the recent spate purporting to come from courier companies, but I had one the other day that was particularly good. It dressed itself up as the “someone tried to login to your Apple account” warning, but gave itself away with poor spelling (Itunnes!!) and of course the URL it was asking you to follow was completely bizarre and in Hong Kong.

One further thing you can do to avoid the risk of inadvertently triggering any malware in any attachments (besides reading your email on a Linux machine rather than a Windows one) is use “print preview” or its equivalent to look at the contents in a passive way. It won’t show the bogus URLs but you can quickly tell if your next action should be to hit the delete button.

Actually, before deleting fraudulent emails, I routinely report them to the Actions Fraud website. It may not do much to prevent people sending them out in the first place, but it feels better than doing nothing. In fact, I do this so often that it seems like I’ve been single-handedly responsible for a recent report based on Action Fraud’s statistics that highlighted my local area as a hot-spot for email fraud!

I can’t say that I have read anything more appalling than the way this customer was treated by Nationwide. I think the staff responsible should all be sacked without references for bringing the firm into disrepute, but I doubt that it will ever happen.

I agree with a Which? reader who recommended that if anyone phones from a bank to tell them that if they have anything important to say, to communicate through the banks’ secure web site, and then put the phone down.

The Action Fraud’s web site says that you have to use their form to report suspicious emails and it will take half an hour to fill in.
http://www.actionfraud.police.uk/report-a-fraud/how-to-report-a-fraud
It used to be possible to just forward the suspicious email to them, but as whoever runs it (or probably their legal department) doesn’t care a **** about other people’s time, they now require this rigmarole. Unfortunately most suspicious emails probably don’t get reported as a result of this.

phil – I trust you pursued them for a ex-gratia payment

JdR – I am afraid you are absolutely right that this rigmarole will result in under-reporting of attempts.

I wonder if white-listing genuine financial addresses would help or whether it would make people less vigilant. Given the insecurity of browsers even whitelisting would be a potential weakness.

Your eBay account needs details only if you want to sell something. As others have written, it is always best to use your browser to go anywhere where a credit cars detail is required, not click on an email however genuine it appears. [ ie enter http://www.eBay.co.uk ]

Both are scams;-The Amazon email attempts to obtain your credit card details from your Amazon account, whilst it’s normally Paypal not eBay who holds your payment details.

I can never understand the logic of this. If they don’t trust you when you call them, why on Earth should you trust them when they call you. Refuse all unsolicited telephone calls – a very good idea.

Its like restaurants who demand your credit card before you order a meal. If they don’t trust you, why should you trust them with your card for a couple of hours? They could be buying a holiday for themselves and their six kids for a month in Miami for all you know. We will say that we will just have the main course and not stay for sweets and coffee (where there is a big mark up) and pay for it now.

Trust is a two way process.

Send them a section 11 notice (from the 1998 Data Protection Act) by post or email and tell them to stop processing your data for marketing purposes. They have to comply within 28 days by law.