[rogerxp]

I had similar with my work account, about £6k went walkies, but was quickly returned.

I remember logging into the online system as normal (using my bookmark) and logging in with the usual ID, 3 randon digits, etc, then could see all our accounts. Everything seemed normal. Went to make a payment and it asked me to type in my entire password to complete the transaction (which went through correctly).

Now, you may say, NEVER TYPE IN YOUR ENTIRE PASSWORD, but I was already at ease so let my guard down. I accessed the site of my own accord (not prompted by some dodgy e-mail), I'd logged in as normal, could see my own accounts, made a transaction as normal. I just presumed, as I was half way through a normal transaction, they'd changed the security measures to just proceeded to follow the instructions. They must have somehow overlaced an invisible page over the page I was looking at and the box I typed the password into was on their page as opposed to the bank's page behind it. I don't know whether this is even possible but can't understand how it could happen otherwise.

To be fair - very bloody clever!!!