Boston-based Internet security company Trusteer sounded a warning this week about a financial institution customer security “training” scam that it recently detected, where the result has been that unwitting users willingly transferred money to cyber criminals.

Trusteer CTO Amit Klein elaborated in a company blog: “In the attack we've recently seen, fraudsters were simply waiting for customers to log on to their bank's website. The bank robber then 'changed' the content of the post login page, to a message, informing customers of an upgraded security system. The customer is invited to go through a training process that intends to help him/her deal with the bank's upgraded security system.

“As part of the training they're asked to make a transfer, to a fictitious bank account, and confirm the transaction using the confirmation code that is sent by the bank to the registered mobile phone. Fraudsters claim that the user's account will not be debited and the recipient's account is fabricated. Of course, the transaction then happens, the money is transferred, and the criminal disappears.”