They've not spoofed a number, just using the caller ID string "NatWest" which is the same as the bank uses for official texts, and means the message comes up in existing threads on most phones.
The message is
"We have identified some unusual activity on your Online Banking. Log In via the secure link http://188.8.131.52/default.aspx to avoid account suspension."
Of course anyone with sense then logs in using the normal website not a non-secure link.
Page looks like a reasonable copy of the normal login page, asks for the normal subset of password/number. On entering a customer number of 11111111, then comes the switch - to avoid suspension please enter all your bank account numbers to unlock access.
So all in all it's quite sophisticated.