Phishing email purportedly from NatWest Bank

Today we highlight one of the more absurd phishing e-mails we have recently received. But it is no less dangerous for all its obvious faults. We urge all residents to proceed with caution when receiving similar communications:

1. DO NOT CLICK LINKS
2. FORWARD TO REPORT@PHISHING.GOV.UK
3. DELETE.

Among the obvious flaws in the e-mail (below) are:

• The ‘From’ address is clearly not from NatWest, which would almost certainly not use ‘Info’ as the sender name for a supposedly important account e-mail.
• The title font is odd, and refers to a case number, but then addresses the recipient as ‘Dear clients’.
• The pretext on which the message has been sent is quite absurd, and the grammar has obvious errors.
• It uses the classic combination of urgency and threat, with a link to click on. We have checked the link and it goes to a suspicious address in France, nothing to do with NatWest or even the banking industry.
• The signoff is clearly not what a bank would use for an important client communication.

As it happens, this was sent to a non-Natwest account holder.

Next Steps

We forwarded the e-mail to report@phishing.gov.uk and received the following response from the National Cyber Security Centre:

“Thank you for forwarding a suspicious message to us. Timely alerts from people like you help us to act quickly and protect many more people from being affected.

---

As of February 2024, the number of reports received stands at more than 29,962,000, with the removal of more than 173,000 scams across 315,300 URLs.

---

We are unable to inform you of the outcome of our review, but we can confirm that we do act upon every message received.

We will analyse the content of the email you have sent to us and any websites it links to. If we discover activity that we believe to be malicious, we may:

• seek to block the address the email came from, so it can no longer send emails
• work with website hosting companies to remove links to malicious websites
• raise awareness of commonly reported suspicious emails and methods used with the help of our partners

Please note…

You should not report a suspected crime to us. If you think you may have been a victim of fraud or cyber crime, you should report it:

• to Action Fraud if you live in England, Wales or Northern Ireland: www.actionfraud.police.uk or call 0300 123 2040
• to Police Scotland if you live in Scotland: call 101

There are a number of ways you can protect yourself from attacks like this and the NCSC has published plenty of advice that will help you to stay secure online; for example:

• The NCSC’s top tips for staying secure online
• Phishing attacks: how to deal with suspicious messages and emails
• Securing your devices

For a full overview of the NCSC’s advice for the general public please see our dedicated individuals and families webpage.

How we handle the information you send to us

• Transmitting information over the internet is generally not completely secure, and we cannot guarantee the security of an individual’s data, which is sent at your own risk. We do however have procedures and security features in place to keep data secure once we receive it.
• We may share details with various government departments, our Law Enforcement partners (such as the National Crime Agency and the City of London Police) and other organisations where doing so is necessary and proportionate for the proper discharge of our statutory functions. We won’t share an individual’s information with any other organisations for marketing, market research or commercial purposes.
• The information we hold is exempt from Freedom of Information requests.
• For further detail on how we handle information you send us, please see our Privacy Statement.
• Further information about reporting suspicious emails to the NCSC can be found at www.ncsc.gov.uk/report-suspicious-emails.”