Phishing - smishing - vishing 

Phishing most often occurs in the form of an e-mail containing a link to a fake website which looks just like a genuine site. The aim of phishing e-mails is to be confused with legitimate e-mails sent out by your bank. Fraudsters very often capitalise on the psychological aspect by making the victim feel stressed and creating a false sense of alarm. Here are two examples of phishing e-mails targeting ING Luxembourg customers who have access to My ING and hold a Visa credit card.

The real sender of the message seems to be part of the "@ing.lu"  domain but is in fact not. Indeed, the way email protocols work allows for the theft of a given email address. The recipient of this type of email (“spoofing” in this case) is put at ease by the sender. The text link invites the reader to click on it due to a situation of emergency and to further call a specific number which is not ING’s. By hovering over the link with the mouse we can see that it does not lead to a page from the https://www.ing.lu site, but to a different malicious website.  Alternatively, the thief could have invited the victim to visit a false ING web page in order to obtain confidential information.

Here, it would appear that the message has been sent from the "@ing.lu" domain, meaning the trust of the reader is gained. Once again, the message portrays an emergency situation and invites the reader to react quickly, this time by calling a telephone number which is not an ING number. Alternatively, the hacker may invite the person to go to a web page to enter their personal and confidential information.

Smishing (a combination of the words SMS and phishing) is the attempt by fraudsters to acquire personal, financial or security information by text message. They act as a trustworthy source, impersonating a bank, card issuer or utility/service provider.

Vishing is a telephone call from a person claiming to be an ING bank employee. This person makes the call with the aim of gathering personal and confidential information.

Fraudsters often capitalise on the psychological aspect by making the victim feel stressed and creating a false sense of alarm. A frequent example involves asking for your My ING login information to lift apparent security measures imposed on your account. In another case, the fraudster can pretend to be part of the IT department of the bank, or from Microsoft support, to invite the victim to download and install a software claiming an apparent software update or a new software, but which is in fact harmful.