In this message are reported the url of the faked service, and an invitation for the user to insert his credentials on that service because some problems with his account has occurred. Thus, since the user considers the message trusted, he clicks on the link and inserts his username and password, so that the attacker, on the faked server side, could capture user’s private data. The key point here is that the user will not realize that the attacker has captured his password because the faked web server will redirect the user to the real web server home page.

A countermeasure is to drop all emails of the type described above, because it is unusual that a bank service forces you to insert your credentials. But if you think the email could be real, then you can visually analyse the url and take care that no manumission has been done on it. However this solution is not always applicable because the url can be obfuscated. So, another solution is to change your ISP DNS servers with the ones provided by a service such as openDNS. A service like that maintains a blacklist of servers IP which are known to be phishing, and so when your browser tries to reach the attacker’s url, openDNS will not resolve the corresponding attacker’s ip.