FRAUDSTERS seeking to con online bank customers can buy internet addresses matching the names of high street banks for as little as £10, raising fears of a surge in phishing attacks.

Banks claim they have beefed up security levels to protect their customers from gangs who dupe people into revealing their account details on fake websites. But The Times can reveal that banks are failing to keep track of thousands of internet domain addresses which are very similar to the institution’s legitimate site. Yesterday, The Times bought the internet address, www.barclaysbank.ws for just £37.

Until now victims of online fraud have been compensated by their bank but there is no guarantee that institutions will continue to honour these debts.

Once thieves have bought a false internet address they are free to send out e-mails which appear to be from a customer’s bank. If the phishing gangs have successfully copied the bank’s website customers can find it very difficult to distinguish it from the real thing.

Thomas Halim, an IT consultant at The Web Company, an internet consultancy firm, said: “Banks should speak to the internet domain registers and provide a list of names that people cannot register. It is also wrong that the registers allow people to register these names (of banks) without asking any questions.”

Barclays Bank yesterday denied that its failure to stop people registering domain names such as www.barclaysbank.ws placed customers who bank online at risk.

A spokeswoman for Barclays said: “We are constantly monitoring other domain names that have the Barclays Bank name in there and we make a business decision on whether to buy them or not.

“In itself it (www.barclaysbank.ws) is just a domain name, it is not a genuine Barclays website. The Barclays message is clear: do not respond to unsolicited e-mails asking for account information, we will never do this.”

To demonstrate how easy it is to buy a false address Mr Halim has registered a host of bank website addresses, including abbeynationalcardservices.com, barclaycardservices.com and hsbccardservices.com.

He said: “What kind of a business decision is it to say that they cannot protect their own customers? “If on the same day that a bank’s website is down, customers receive a phishing e-mail asking them to go to an alternative website registered by a fraudster impersonating a bank, it could be easy for customers to be tricked into revealing their account information.

“Instead of talking about online security like it is a space-age thing, the banks should pay attention to how the problem starts and speak to the domain registers and ensure that their names are not taken by fraudsters.”

Recent high-profile security breaches at cahoot, Abbey’s internet bank, and the Morgan Stanley credit card website have raised the profile of internet security.

Cahoot closed down its website for ten hours following a tip-off that users could view other customers’ private details. Morgan Stanley was last week forced to upgrade security on its credit card website after it emerged that users could access credit card account information simply by entering the first digit of a credit card number.

Steven Philippsohn, a partner at Philippsohn Crawfords Berwald (PCB), a City law firm specialising in tackling fraud, said: “Given the billions of pounds that banks make in profits, it is very concerning that they are not taking measures to challenge people who are taking out these names.”

“It takes 300 hours to get your credibility straight if you are a victim of identity fraud and I think the banks should take a more proactive approach against fraudsters,” Mr Philippsohn added.

Explore UK News

• Crime News

• Education News

• Health News

• Scotland News

Times Recommends

• Queen uses Christmas speech to praise Forces
• Helmand Christmas — the briefest of respites
• Hard work — but the finest bacon