Dear client of the Halifax Internet banking,
[..] We earnestly ask you to visit the following link and to confirm your bank data: [..] This instruction has been sent to all bank customers and is obligatory to follow
Please do not answer to this email [..]
Ok, let's see what the purported link of https://www.halifax-online.co.uk/ etc actually is.
Gosh, it really is https://www.halifax-online.co.uk/ etc, none of this 'genuine-looking-address@dodgy-one' or 'IP-address/genuine-looking-rest' stuff.
OK, let's do a whois.
Domain Name: halifax-online.co.uk
Registrant: Halifax plc
Yeah, yeah, that's what they all say.
Administrative Contact's Address: Inca Research Inc, Victoria Chambers, Fir Vale Road, Bournemouth, BH1 2JN.
Ha! Well, there are some companies that let their suppliers manage their domains, but an Inc (rather than Ltd or plc) in the UK?
Relevant Dates: Registered on: 26-Apr-1999
But gosh. If this were a 'let's register a plausible sounding domain name and see who bites' scam, you'd have expected Halifax to have stomped on them years ago.
A check of Nominet's dispute registration scheme does show that Inca are real but have have been naughty in the past.
OK, let's be brave and look at halifax-online.co.uk - hmm, the certificate is valid, the site looks genuine. The IP address is 126.96.36.199 vs 188.8.131.52 for halifax.co.uk, too.
Gosh. Have I been spammed by a dodgy email that actually points to a genuine site?