False messages using the name cttexpresso - Do not open the links
Please beware of e-mail messages supposedly sent by the postal services cttexpresso with the subject "A Empresa de Courier não foi capaz de entregar," (the company was unable to deliver) indicating that the "A empresa de courier não foi capaz de entregar o seu … pacote para o seu endereço" (the company was unable to deliver a package to your address) and asks that you “download de informações” (download information) to print and take to the post office to pick up the (alleged) package.
Example of the e-mail sent:
This is another case of Phishing wherein, when you access the link sent, you are requested to install a zip file, followed by an executable file (.exe),
After this malicious software is installed on your computer, we verified that, when you login to the website, you get a pop-up regarding our web page, warning that you need to install a security module “Instalação do Módulo de Segurança”, asking you to enter your mobile phone number and Multichannel Code, afterwards sending a text message with an Authorization Code, as per the screen images below:
|Click image to zoom
||Click image to zoom
||Click image to zoom
||Click image to zoom|
Following this phishing of the User's Access Codes, the cyber-criminal requests an Authorization Code to be able to register the Millennium App and an SMS will be sent saying:
“Pedido de registo na App Millennium - Cod. Authorization: ******* (Request to register the Millennium App - Authorisation Code: *******). Contacte o Banco caso não tenha solicitado este código (Contact the Bank if you did not request this code)."
Do not enter the Code you received on your mobile phone to confirm the fraudulent installation of the alleged security module.
Please be reminded that:
- To access Millennium bcp's homebanking services, the Bank NEVER requests your mobile phone number or the installation of security software;
- Whenever you access your bank accounts through the Millennium bcp website, check if the address starts with https://ind.millenniumbcp.pt/ (for the Individuals access) and https://emp.millenniumbcp.pt (for the Companies access) and that, at the end of the address bar, a lock is shown, as follows:
- Millennium bcp's website is accessed using a User Code and three random positions of the Multichannel Code (if your enter a wrong number, the three random positions requested remain the same until you login successfully);
- You should beware of any e-mail that requires "immediate action" or creates a sense of urgency, especially if it shows spelling errors or bad grammar, links and attached files;
- Carefully read the SMS received containing the Authorisation Codes since the transaction data are identified in the SMS;
Remember: The protection of your assets and of your computer depends on you!
If you ever find something out of place at www.millenniumbcp.pt/en or if you need further information please call us on 91 827 24 24 / 93 522 24 24 / 96 599 24 24 / +351 21 005 24 24 (from Portugal or abroad) (Personal Assistance 24/7).
You can read all the Security information available here. (Companies)
You can read all the Security information available here. (Individuals)