Internet fraudsters have developed a sophisticated new method of using e-mails to capture internet banking customers' details.

The technique is the latest variant of a process dubbed "phishing", which has been used by criminal gangs to target millions of unsuspecting computer users.

Experts at MessageLabs, the electronic security firm, have identified e-mails that to be appear empty if opened, but which immediately infect computers with a piece of software.

The programme - known as a "script" - runs in the background without the victim's knowledge and is designed to overwrite the website addresses for any bank stored on the computer.

The next time the user clicks on the address, they are automatically directed to a bogus website. Fraudsters use this authentic-looking site to steal passwords and financial details.

The e-mails appear to be sent by a stranger and usually have a blank subject line. Previous scams have relied on people opening attachments to trigger programmes - a process of which most regular internet users are now wary.

MessageLabs spotted the latest e-mail threat among customers of three Brazilian banks over the past week.

The company is concerned that the criminals behind the scam will seek to widen their net and target online account holders elsewhere in the world, including the UK.

It is estimated that phishing scams cost an estimated £4.5 million in the nine months to June.

In the past, crooks have sent e-mails to customers claiming to come from their bank and asking them to visit what turns out to be a fake website in order to "update" their details.

Customers of eBay, the internet auction site, have also been targeted in "phishing" attacks.

"Most banks have advised their customers to be wary of any e-mail asking for personal banking details, but in this case all they have to do is open an apparently innocent e-mail and their bank details could be silently sabotaged," said Alex Shipp, senior anti-virus technologist at MessageLabs.

"We have seen it among customers in Brazil but if it works there, the likelihood is it could spread," he added.

Security experts last month accused high street banks of shirking their responsibility to make internet banking secure after it emerged that online bank customers had lost £4.5 million to fraud in the nine months to September.

Paul Docherty, technical director of Portcullis Security Systems, the security consultancy, said a consumer awareness campaign launched by the banks to warn consumers of the risks of internet banking was an attempt to shift the responsibility for stopping fraud on to the consumer.

Mr Docherty said that banks refused to upgrade their security systems on the grounds that informing all 14 million customers about security changes would be time-consuming and costly.

The Association for Payment Clearing Services (Apacs), a body representing the banks has launched an advice website - www.banksafeonline.org.uk - to help to prevent people from falling victim to internet fraud after it published research indicating that nearly half a million people would respond to "phishing" e-mails

Apacs revealed that 2,000 people had fallen victim to phishing attacks. Apacs has urged people to take steps to protect their computers against spam e-mails and viruses, which can infiltrate computers record bank details.

Experts advise all computers users to ensure they run up-to-date anti-virus software and security "patches" that can be downloaded from the internet.

Times Recommends

• Lies and cover-up at MG Rover exposed by report
• High oil prices push manufacturing costs up
• Primark founder steps down as chief executive