Thread: HSBC Online Banking BEWARE

OK been logging on to hsbc online banking for years now and i'm pretty clued up on online scams and fake pages etc and warn people about them all the time.

last week i was logging on and it asked for my full security code... this set off alarm bells so i instantly checked the URL it was legit so put my details in as i just seen it as another added security check.

for the past 2 days when logging in there were 2 forms asking for this so i couldn't log in. i just seen this as a website error so i contacted them to fix there site.

got an email back about half an hour ago saying they NEVER ask for the full password

so i have just phoned them up to change my security number.

just thought id post that here because i think it was a virus that auto added a firefox addon... it was a bloody good one thats for sure, so thought i would mention it to you guys as i feel lucky because my account would have been cleared by next week if i hadn't have checked it

I'm gonna change all my online passwords now to be on the safe side... close call.

just found this article on it... pretty scary shit really....

In the battle against online criminals, a new front has emerged involving Zeus, a data-stealing Trojan horse that infects Windows PCs, according to researchers at Dasient, a Web site security firm founded by Google alumni.
The researchers say that beginning last month, Zeus has been staging new targeted attacks on the customers of certain banks, including HSBC and Alliance & Leicester in Britain, and Citibank’s German site. The banks say they have taken steps to protect customers.
The Zeus Trojan, which first appeared in 2007, sells for $3,000 to $4,000 in the online black market and is the most popular tool for financial fraudsters on the Internet, according to SecureWorks, a firm that supplies security services to companies. Criminals have used it to create hundreds of botnets, or networks of infected machines, according to security analysts.
The new Zeus tactic, described by Dasient in a June blog post, allows criminals to detect when an infected PC visits one of the specific online banking sites. Then, in place of the real site, it displays a fake site created to filch account numbers, login names and passwords.
Although only a few banks are targeted, Neil Daswani, Dasient’s co-founder and chief technology officer, said, “This is an alarm bell for financial institutions.”
Spokesmen for HSBC and Alliance & Leicester said that they were battling Zeus, but that they did not believe they were being targeted specifically. In addition to behind-the-scenes measures, they said, they both offer customers free security software — Rapport, from Trusteer — which protects online transactions and helps customers make sure they are on the correct Web site. Citibank, which sold its German business to Crédit Mutuel in 2008, said the Web site that was the target of the attack was little used.
Stopping the new Zeus attack can be tricky. Unlike traditional phishing attacks, it does not involve e-mail lures that can be blocked by spam filters or Web domains that can be removed from the Internet.
To infect computers, attackers lace Web sites — 1,027 of them and rising, according to Google — with an invisible malicious link. Visitors are quietly infected with Zeus in what’s known as a drive-by download, most likely after finding one of these malicious site on a search engine. Google, which tracks malicious sites to keep them out of its search results, declined to comment.
Avoiding Web-borne infections is increasingly difficult, because many malicious sites are legitimate sites that have been hacked. But here are four steps to take to protect your computer:

1) Use the latest version of your favorite Web browser, because most have important anti-malware technologies not available in the older models. Consider using Google Chrome, which uses so-called sandboxing technology to stop drive-by downloads.
2) Keep your Web browser, Adobe products and other software up to date, and remove software you don’t use. The new Zeus attack checks potential victims’ browser version, operating system and third-party browser plug-ins to find a hole to exploit. Miss anything, and you could be hit.
3) Consider using tools like McAfee SiteAdvisor and the Firefox add-on Web of Trust to get warnings about dangers in search results.
4) To block, find and remove Zeus and other malware, use up-to-date antivirus software. You may also be able to avoid infection by using K9, a free tool from BlueCoat, that can block Web-based attacks. See if you have an infection by running a quick free scan with Microsoft’s Malicious Software Removal Tool.

Thanks they could clear me out too.