Nat West Phishing Scam
If you have a bank account with Nat West this might alarm you thinking some unknown person is trying to change your contact phone number (the one you receive one time passwords) But don't jump to cancelling the phone number change. This email is not personally addressed to you, just to "Dear Customer", the email could be sent to hundreds of recipients telling them of the same mobile phone change also they will not have sent any notification to your present number as they don't know it.
This is the email we received
E-Mail received:
Date: 10/09/2025 13:07
From: NatWest info.email.NationalWestministerBankPlc@secure.com
To: [Name Redacted]
Subject: NatWest - Your Contact Details Has Been Updated Successfully.
Notes: Sender email addresses: info.email.NationalWestministerBankPlc@secure.com, has an appearance of being from Nat West but it is the part after the @ that matters secure.com is a cybersecurity company, an email adddresses using their domain name may have been spoofed.
Click through link: https://m0biledwealthy-coal.surge.sh/0nt78bg09t.html?email=[email address redacted]. Surge.sh is a free publishing platform which allows them to hide their identity.
A second email was received on 16th Sept 2025
A further email was received asking us to Activate Authentication (I am not sure even they know what that means), again a way of obtaining your details for fraudulent purposes.
E-Mail received:
Date: 03/10/2025, 18:20
From: NatWest info@dgslandscapes.com
To: [Name Redacted]
Subject: Secure your account - Important !
Notes: Totally fake sender email address... why would a legitimate bank be contacting you using the email address of what appears to be a landscape gardening company? Whilst the e-mail is sent directly to our email address we are addressed as "Dear customer" showing that the same email has sent to many recipients.
Finally the click through web address is: https://aupaysdubonvin.fr/gb/, a French website. This website address does not appear to have any connection with the Nat West Banking Group.
Recommendation: Delete the email.
Michael Fowler
Other articles by Michael Fowler:
Contract Form Approval Phishing Scam - Michael Fowler
I was not expecting any Docusign notification for an EFT (Electronics Fund Transfer) contract so I knew it was a scam email to try and obtain my login details... more >>
Voicemail Phishing Scam - Michael Fowler
I don't know why I would get a genuine voicemail notification, it is supposedly from a service called GVoice Encrypted. Follow the usual rules don't click on anything... more >>
Verify Your Email Address Phishing Scam - Michael Fowler
The sender email address has been spoofed to appear to come from your own email address. Slightly different wording but the same objective to obtain email password credentials and access to bank accounts and untold other financial goodies... more >>
