A convincing fake ANZ Bank phishing email is today targeting customers. The e-mail advises recipients that their ‘last payment was unsuccessful’ and prompts them to login, so those behind the attack can harvest banking credentials.
The scam email hit a very large number of inboxes in a short space of time this morning, and is continuing. MailGuard began blocking the emails at 8.16am this morning.
The email, from a display name of ANZ Internet Banking and sender email address of customer.data@anz.com, claims that ANZ have been unable to contact you, and asks customers to click to update their phone number.
When recipients click through they arrive on a well-crafted ANZ Internet Banking landing page where they are prompted to login, so doing handing over their Customer Registration Number (CRN) and Password.
For those that continue past the Internet Banking login page, the scammers try for even more sensitive data by asking recipients to divulge the answers to three ‘security questions.’
How to tell this is a fake
Poor grammar is always a tell-tale sign. Though this scam is quite well constructed, the email provides some clues that this is a scam.
Firstly, it is not personalized to you as a customer.
Secondly, you can check if your account ends with ****524 as the email claims. This would be an extremely unlucky coincidence.
One of the surest ways to detect a fake is to hover over the email sender name, or in this case also check the landing page URL, to see if it looks legitimate. In this case, the landing page resides at https://djarlo.net/anz which is a clear indication that it’s not a genuine Internet Banking page hosted by the ANZ Bank.
Finally, as is often the case, there are some clear grammatical errors that hint that this may not be legitimate, and are early warning signs or red flags, that the email may be a scam.
Advice from ANZ on reporting fraud
“Quick rule of thumb: if it sounds too good to be true, it probably is,” ANZ advises.
“Delete the email or SMS immediately. Please contact the ANZ helpdesk immediately if you have:
- Clicked on any links or downloaded any attachments
- Responded to the hoax email, SMS or phone call with your banking details
- Noticed any unusual payments.”
For a few dollars per staff member per month, add MailGuard's cloud-based email and web security to your business security. You’ll significantly reduce the risk of new variants of malicious email from entering your network.
