This morning I received a text message (ostensibly) from my bank:
We need to contact you. Please visit https://paymentassistance.nationwide.co.uk for more information
My spidey sense immediately tingled. I've never received an SMS from my bank before, and when they email me they always use my name and post code. However nationwide.co.uk is the correct domain for my bank. Out of curiosity (and with a healthy scepticism) I typed the URL on my computer.
Is it a phishing site?
- It uses the same theme and colours as the familiar website http://www.nationwide.co.uk
- It has a https URL (certificate from Symantec)
- It has links to the familiar website in its footer, but its own version of the 'contact us' page with an alternate phone number 0800 464 3050. Compare https://paymentassistance.nationwide.co.uk/doc/contactUs with http://www.nationwide.co.uk/support/contact-us/call-us#xtab:credit-cards
- That phone number only appears on that page and not on the familiar website or elesewhere on the web. It differs from the number printed on my card (0800 055 66 11)
- The form asks for your name, address and last four digits of your credit card number (not the whole thing)
- If you try to login (I used made up data) it fails and asks you to phone them (on the suspicious number)
- If you phone the number a recording answers "Welcome to Nationwide credit card services. Your call may be recorded for quality and training purposes."
- The recording then asks for all 16 digits of your credit card number.
- After entering a made-up 16 digit number, a friendly lady calling herself Kelly answered the phone. I hung up.
If this is phishing, I don't understand:
- How did scammers take control of a subdomain? Have they hacked Nationwide's computers? (DNS servers?)
- How did they get an SSL certificate for it?
It looks like this page has been running since at least January 2014:
The Twitter user asked the bank about it, but they didn't reply.