This time the phishers have targetted a new bank - Sovereign Bank. It is obvious that this phish is a part of a wave of such attacks - the proof lies in the phish IP. There is at least one more attack hosted on the same IP.

Compared to the phish samples analyzed the last few days, this one is less cunning. Obviously, the phishers think they can catch Sovereign Bank's customers unprepared, since this is one of the first attacks directed at this bank.

The phish message comes with no bank logos or legit header/footer. But the sender is spoofed, and the URL link is 'masked'. This alone could be enough to mislead the unprepared. The phishers have avoided typing 'sovereignbank.com' in the phish URL in an attempt to avoid spam filters:

As you can see, the phishy URL is visible here, too. Furthermore, there is no browser indication of secure session (the padlock in the right part of the status bar), and the URL does not start with 'https'. Transferring sensitive customers' information via an unsecured http session is not something a legitimate institution would do.

One more note - the phish site will actually check whether the CC number enter is 'valid'. This means that it will run the number against a publibly available mathematical routine, by which the CC numbers are created. This check is enough to reject a random bogus number (like 123123123123). Rejecting a bogus number could persuade the potential victim into the wrong conclusion that the site has credibility. In fact, the simple check does not require any specific CC or bank insider information and is completely routine.

After eventually phishing the requested information, the phish site redirects to the legitimate sovereignbank.com page on privacy policies. This is designed to be a 'track covering' move. Notice the difference in the URLs, now that the legitimate one is opened: