Mass email fraud for UK bank TSB
It's a stupid name: TSB is an acronym for Trustees Savings Bank and then some idiot, years ago, decided to add "Bank" to the acronym, in a move that rivals the equally stupid "ATM machine." But that's not the reason this heavy-duty spam-scam mailout is an obvious fraud. Warning: the content is highly plausible and the mail constructed to avoid even aggressive anti-spam filters.
Headed "New Tsb Service Notification" (note that the acronym has been reduced to a pseudo word), the e-mail is not individually addressed. Indeed, its supposed mailout address is service at tbsonline.com .
The body of the e-mail is, seemingly, authentic.
"Important Notice
Please Note: Starting from 1st June 2018, we will be implementing new login authentication procedures in order to safeguard your account information due to the recent techincal error that our online server has been experiencing for sometimes now. Part of these procedures will be the introduction of our two step authentication system which will prevent access to your account by a third party, this system will work by comparing information from the device being used to access our sites against data we previously hold regarding the devices you most frequently use.
In order for us to launch these new login authentication procedures we require you to complete our account verification process this should only take you a few minutes to complete and will help us in safeguarding your account information.
Get Started
Please note: Failure to comply with our account verification process may lead to temporary suspension of access to your online and telephone banking service.
Best regards,
TSB Online Banking Team
It's the threat that gives it away. It's too blunt.
And then there's the routing.
tsbonline.com is registered in Australia by above.com with a DNS at NS3.ABOVE.COM
The mail was routed through itscom.net - an internet host in Japan.
It also flew through the amazonaws.com network, a favourite of internet criminals
Finally, the links in the mail include click.co. za

