Barclays calls in cyber-police

Barclays has called in the cyber-police and slapped a limit on online cash transfers in an attempt to head off an email fraud aimed at its internet banking customers.

The scam is similar to recent frauds involving Citibank and auction website eBay. Over the past week, emails claiming to come from Barclays have asked customers to log on to a fake website and enter personal details and passwords, which could then be used to withdraw or transfer funds.

The email carries a link to a website that is very similar to the bank's site, and uses a redirection ploy so it appears to be www.barclays.co.uk.

Barclays is taking necessary action against the fraudulent websites and closing these down as we become aware of them," the bank said. "As a precaution, we have decided to protect further our customers' interests by temporarily reducing the daily payment limit to £500."

The bank introduced the temporary limit and called in national law enforcement agencies' hi-tech unit to investigate after 400 customers contacted Barclays regarding the emails. Barclays has a total of 3.5m online customers.

The bank said eight customers admitted entering personal details on the bogus websites and have had their accounts frozen as a precaution.

The fraudulent emails first came to the bank's attention last week when the emails - sent to random addresses - were picked up by internet se curity companies. "We are stopping hundreds of [email] spams an hour directing Barclays bank customers to fake login sites where you are invited to enter your user name and password," Alex Shipp of security firm MessageLabs told The Register IT website.

"The bad guys then log these and clean out your account.

"The URL [website address] looks like it points to www.barclays.co.uk. However, it points to one of at least eight fake sites."

The bogus sites appeared to be run on commercial internet servers based in Maryland and California, in the United States.

Barclays said it had contacted the commercial hosts, closed down five out of six sites it had identified and had the sixth site locked.

The bogus email is signed "Barclays Customer Care," and begins: "Dear valued customer, our new security system will help you to avoid frequently fraudulent transactions and to keep your investments in safety."

It then tells users: "Due to technical update we recommend you to reactivate your account." It ends: "We appreciate your business. It's truly our pleasure to serve you."

Barclays said it does not ask customers for complete details such as a full password when they log on and they should be wary of providing personal information over the internet.

The bank has established a telephone helpline for customers who are concerned about the fraud. The number is 0845 600 2323.