Police say students on government loan schemes conned into revealing bank details, which were then used to withdraw money
Six people have been arrested over a ?1m online phishing scam in which money was stolen from the hacked bank accounts of hundreds of students.
Scotland Yard said a criminal network targeted students on government loan schemes, conning them into revealing their bank account details, which were then used to withdraw amounts of between ?1,000 and ?5,000 at a time.
The victims received emails asking them to update details on their student bank account via a link to a bogus website.
The Metropolitan police's e-crime unit launched an investigation after being alerted to the scam in August and on Thursday seized computers and other equipment from addresses in London, Manchester and Bolton.
A 26 year-old man and a 25 year-old woman were arrested in Manchester, a 25 year-old man was arrested in Deptford, south London, a 49 year-old woman and a 31 year-old man were arrested in Stratford, north-east London, and a 38 year-old man was arrested in Bolton.
Detective Inspector Mark Raymond from the e-crime unit said: "A great deal of personal information was compromised and cleverly exploited for substantial profits. We have today disrupted a suspected organised group of cybercriminals and prevented further loss to individuals and institutions in the UK.
The suspects, who were arrested on suspicion of conspiracy to defraud, money laundering and Computer Misuse Act offences, were being held at police stations in central London, Manchester and Bolton.
The investigation was carried out with the assistance of the Students Loan Company, the banking industry and internet service providers.
Phishing is the act of defrauding an online account holder of information by posing as a legitimate company. It usually involves spam emails being sent to people pretending that there has been a "security update" to their bank, credit card, online shop or similar system.
The user is lured by an email to go and view a webpage, often under the pretence of a "security update", which superficially looks credible but is a fake. The fake page usually include copies of all the elements of the real page, such as an Amazon or eBay page, but is hosted on a hacked server or PC.