with a download attachment called "verify.htm"
ITS FALSE
the email states that it comes from "gradeencrypt@natwest.co.uk"
At NatWest Online Bank, we want to increase your security and comfort level with every transaction. From our Buyer and Seller Protection Policies to our Verification and Reputation systems, we'll help to keep you safe.
We recently noticed one or more attempts to log in to your NatWest Online account from a blacklist IP address and we have reasons to belive that your account was Compromised by a third party without your autorization.
If you recently accesed your account while traveling the unusual log in attemps may have been initiated by you.
However, if you the rightfull holder of the account, download the form attached to this email, fill the form and then submit as we try to verify your identity.
If you chose to ignore our request, you leave us no choise to temporaly suspend your account.
We ask that you allow at least 72 hours for the case to be investigated and we strongly recommend to verify account in that time.
We advise you to store this message on your private e-mail.
Best Regards,
NatWest Internet Banking
Online Security Team
The senders address is:
http://www.schoder.at/shop/images/login3.php?refererident=edsaafgesa7904B2CF928DF2D6E556DED4337&cookieid=91155&CookieCheck=2009-10-21T18%3a12%3a17
which is not Natwest, most emails go to Natwest.com not co.uk
The other slight detail to this is that the Natwest logo is not fully matched in colour to the blue bar, look carefully its slightly purple.
it basically sends what you type to that website.
