Offshore banking

Of course it's genuine. Banks are always sending out spam mails to attract customers.

Email headers can be forged, so the result would prove nothing.

If the email is solicited, addresses you by name and contains references to matters you have discussed with the bank by letter or telephone, it is unlikely to be bogus.

Why not telephone the bank (using a number you got from a directory lookup rather than from the email), ask to speak to the person who apparently sent the email, and ask him/her to verify that s/he did indeed send you an email on the date & time in question.

The OP stated that it was a solicited email - IOW *not* a spam.

A whois look up on RIPE resolves it to Royal Bank of Scotland International, Jersey CI.

The telephone number that the OP gives draws a blank.

It is true that (some) email headers can be forged. But you can also be sure about some of the headers because they will have been inserted by an MTA that you trust (for some definition of trust if you use someone elses MTA to receive your email and then collect it via pop3 or imap). This will include at least the last(top) Received: header.

Received: from 125310-batch1.tfl.deloitte.co.uk (125310-batch1.tfl.deloitte.co.uk [78.136.2.116] (may be forged)) by einstein.home.woodall.me.uk (8.14.3/8.14.3/Debian-5) with ESMTP id n2G29e5k002384 for ; Mon, 16 Mar 2009 02:09:41 GMT Received: from 125310-batch1.tfl.deloitte.co.uk (localhost [127.0.0.1]) by 125310-batch1.tfl.deloitte.co.uk (Postfix) with ESMTP id 17BB1710194 for ; Mon, 16 Mar 2009 02:09:35 +0000 (GMT) Date: Mon, 16 Mar 2009 02:09:35 +0000 (GMT)

I can be sure that this email came from 78.136.2.116 because my mailserver added that header. (That "(may be forged)" is because

Tim.

So it is a *bit* dodgy then...?

Of course, if the tax lot can sell all their buildings to a tax dodge company and rent them back to save money, all that sort of thing must be OK for us mere mortals as well. No?

(125310-batch1.tfl.deloitte.co.uk [78.136.2.116] (may be forged))

The only mailserver that knows the originating (sender's) IP address is the first (outgoing) server that was chosen by the *sender*. If that server is compromised and substitutes a different IP address, none of the servers further down the line will know any different.

So the "trusted" server must be the outgoing server that the email sender has used, not the email server that *you* use to receive mail.

If the sender is bogus, then of course he will deliberately use a compromised outgoing mailserver!

(125310-batch1.tfl.deloitte.co.uk [78.136.2.116] (may be forged))

n2G29e5k002384

Yes. But RBS etc don't relay via random servers on the web, they send from their own servers. So you will see something like:

Received from ISP-INCOMING by ISP-POP Received from RBS-OUTGOING by ISP-INCOMING Received from RBS-USER-1234 by RBS-OUTGOING

If you trust your ISP then you can trust the first two headers. That means you know it came from RBS. (I'm assuming you've verified that RBS-OUTGOING has an IP address owned by RBS which is where this thread started)

Someone trying to forge an email could forge headers:

Received from RBS-OUTGOING by ISP-INCOMING Received from RBS-USER-1234 by RBS-OUTGOING

but now when they try and send it to your ISP your ISP will add another header:

Received from ISP-INCOMING by ISP-POP Received from FRAUDULENT by ISP-INCOMING Received from RBS-OUTGOING by ISP-INCOMING Received from RBS-USER-1234 by RBS-OUTGOING

The chain is broken

Or they could try:

Received from ISP-INCOMING by ISP-POP Received from FRAUDULENT by ISP-INCOMING Received from RBS-OUTGOING by FRAUDULENT Received from RBS-USER-1234 by RBS-OUTGOING

Now this time the chain looks good. You trust your ISP so you can be confident it came via FRAUDLENT. But as you don't trust FRAUDULENT you are suspicious that it didn't originally come from RBS.

(The first example of trying to forge headers is seen in spam. I doubt that they ever go to the trouble of trying to make the chain look good, they just try sticking an apparently good Received header at the bottom to try and throw off complaints to the wrong ISP. Maybe next time I get a phishing email I'll take a look and see what they're currently trying)

Tim.

Why not use the bank's secure online banking site, verified phone number or go to a branch?

What's the advantage of an off-shore account anyway? If you live in the UK, you still need need to pay tax.

It is impossible to say what possible advantage an offshore account may or may not have without knowing the OP's situation. For starters, perhaps he *doesn't* reside in the UK for tax purposes.

Well Nat West is a subsidiary of RBS.

If you have money in RBS or HBOS you might be advised to move to another dodgy foreign* bank...

• as in not English

You've received a message without a digital signature, let alone one signed with a high trust certificate, and checked by a browser with known provenance. You are not an expert in internet security. I would suggest you can have low to medium confidence.

The realistic risk depends on to what extent someone thinks it worth targeting you, or the bank.

If you have any doubt at all, go to a major reference library and look up the phone number of the bank in a paper or microfiche phone directory, then call them and check. If you are feeling paranoid, make the call from a random phone, not near to your home or office.

You might want to note that, in my experience, banks do not trust emailed instructions and will only trust faxed ones by prior arrangement.