The message has the subject "Netbank Security Server Update" and asks recipients to reactivate their NetBank accounts. The HTML message grabs a genuine Commonwealth Bank graphic, but the hyperlink that purports to take the reader to the NetBank site actually points to a server identified only by an IP address.
Anyone viewing the message as plain text is unlikely to be fooled, but the default setting for many email programs is to show HTML messages fully-formatted. The IP address used by the bogus web site is apparently allocated to a Taiwanese telco, but the site itself has now been taken offline.
"If customers have received an email requesting personal information they should delete it. It is not from the Commonwealth Bank," read an advisory issued by the bank. The bank goes on to advise anyone who responded to the instructions in the fraudulent e-mail to change their password via the Netbank site, and check their account details.
The spam contains other clues that it is fraudulent, including awkward phrasing such as "to keep your investments in safety" and grammatical errors, for example, "Due to technical update we recommend you to reactivate your account".
"We are working closely with the relevant authorities to identify persons behind these attempts to defraud," said John Geurts, Head of Group Security in a statement.
The bank is assuring customers that the Netbank system is secure.
Melbourne IT customers have also been targeted by spammers seeking credit card details today. The spam uses a malformed URL to make it appear to be from Melbourne IT, and claiming the customers need to renew their domain or risk losing it.
The Web site users are taken to has nothing to do with Melbourne IT, and is not secure, despite an 'important security notice' on the site claiming it uses 128-bit SSL. Melbourne IT has issued a statement advising people to ensure that any site in which credit card details are entered is secure, which is denoted by a padlock symbol at the bottom of the browser.
Members of a discussion group that I belong to have received similar requests purporting to come from Amazon and Ebay.