Fishing for Phishers

mleachpdx writes "This blog entry probes into the details of an online banking phishing scam and suggests some fraud deterrence and detection measures."

Comments

More Info Available here

[LiquidCoooled]

Full article mirror here:
mirror.slashdot .org article

Theres currently a problem with our server, you will have to login again to see the details.

(yes this is only a joke)

Re:More Info Available here

[Carnildo]

How many valid Slashdot logins did you get from that?

Or....

[jmcmunn]

From the article: "The home page of the phishing site looked identical to the actual online banking site. I was impressed. Someone had spent a considerable amount of time mirroring the entire look and feel."

Or they just used the Spiderzilla extension for FireFox and downloaded the entire site. Wow, that scammer went to a lot of work. I have gotten these scams before though, and it is no laughing matter that they go to a lot of trouble to look legit. And I bet the estimate of 15% of people who fall for it listed in the article is actually a little low.

Re:Or....

[davesplace1]

It is scary when the phisher can make it look so real. I get so many emails from "banks" that if my real bank every sent a email it would get deleted.

Solution: You authorise the bank first

[Anonymous Coward]

When you sign up, the bank asks you for your 'personalised code', and that will be displayed in every email you recieve from the bank.

If you dont see that code in your email, or it's wrong, you know its fraudulent.

Re:Solution: You authorise the bank first

[BobTheLawyer]

Do any real banks send e-mails to customers? As far as I know, no UK bank does.

Re:Solution: You authorise the bank first

[gl4ss]

the *REAL* solution: don't email the customer EVER.

My bank doesn't even HAVE my email.

Re:Solution: You authorise the bank first

[torenth]

Mine certainly doesn't, for which I'm glad.

Re:Solution: You authorise the bank first

[legirons]

"When you sign up, the bank asks you for your 'personalised code', and that will be displayed in every email you recieve from the bank. If you dont see that code in your email, or it's wrong, you know its fraudulent."

And this code would be sent through which secure email-delivery system exactly? Plaintext SMTP on the internet, like all the other emails from your bank?

Hell, banks don't even sign their emails. Many of them don't even know what PGP is. How many of us have had conversations with our banks along the lines of:?

You: I just got an email purporting to be from you

Bank: Yes, that's right

You: So how do I know it's real without phoning you

Bank: Because it's got our name in the From field

You: Did you ever consider signing your emails

Bank: OUR INTERNET IS SECURE, WE USE HTTPS WEBSITE!!!

Re:Solution: You authorise the bank first

[Anonymous Coward]

What the hell has secure-email delivery got to do with it? Unless the phishers have somehow gotten hold of an email from your bank to you, they wont know your phrase, simple as that.

Re:Solution: You authorise the bank first

[legirons]

"What the hell has secure-email delivery got to do with it? Unless the phishers have somehow gotten hold of an email from your bank to you, they wont know your phrase, simple as that."

Okay, and how do the spammers get somebody's email address to start with? Oh yes, a virus emails the contents of their inbox to a russian server"

Along with your special code.

And don't pretend that you can just secure your computer -- there have been 5 major windows viruses already this year, and as far as I can tell, nearly every windows user I know has been infected.

As to secure delivery, have you noticed the number of people buying wireless networking kit? Most of those people are transmitting their POP and IMAP connections in cleartext to anyone within range. Dumpster-diving doesn't even require getting dirty any more.

A code could work well, I admit. But it might need some small changes, such as sending a numbered list of codes in the mail, and writing something like "this is email #403 from us and code 403 is blah" in each email. But anything which relies on computers, inboxes, and emails being perfectly secure starts to sound like a bad idea when you mix it with banking.

Re:Solution: You authorise the bank first

[fbjon]

Good point, but suppose this happens:

Your DNS, or the DNS for your area, is hijacked, and everybody who use that DNS is called up and told to log on to their bank in order to do something important?

Second solution is:
One-time passwords. I have a long list of login passwords and confirmation passwords, and a numerical customer ID known only to me. When they start running low, I can easily get a new one (mailed to me). So what if I happen to login to some fake site? The worst that can happen is that I waste some time and a little bandwidth, since they can't do anything with only one part out of three (the ID), and anything I do with the fake stuff won't happen anyway. Besides, I'd be mighty suspicious if the balance of the account(s) isn't correct, since that is what I see the moment I login.

Re:Solution: You authorise the bank first

[gl4ss]

the way it's been done here for almost a decade is this.. you have login and a password(which happen to be numbers) which you use to 'get in'.

then to do any transactions, to open any accounts, to apply for a loan or just about anything other than just checking how much cash you have the system asks a number from a list of one-time passcodes they've sent to you through regular mail(basically "enter the number pair for the number 4323 on your number card").

the card with the one-time-use passcodes is a plastic credit card shaped one, too. easy to have in the wallet, but totally useless without the other codes needed to get into the site.

Re:Solution: You authorise the bank first

[fbjon]

Sure, I'd say that's good enough, but someone could still check you account balance whenever he wants. (I'm assuming the login thing never changes) In my case, you need the one-time pass even before that, and the paper they come on can be folded and put in the wallet too :). After doing your business, you confirm with a pass from a second list, that you can store separately if you want.. you could for example do all money transfers from one location, and then confirm everything from another computer/city/country entirely. I don't know if knowing the balance is a significant risk of anything though..

Re:Solution: You authorise the bank first

[ScrewMaster]

Mine has the option to send what they call "email alerts", for example if your balance goes below a certain point they send you a quick note. There's a whole bunch of different triggers you can set online to determine what kinds of alerts you get. Kind of handy, actually. But they're strictly informative messages: no requests for passwords or anything like that. Of course, they all come addressed from "The Financial Team" which my spam filter decided was too spam-like and proceeded to remove them.

Re:Solution: You authorise the bank first

[Anonymous Coward]

"Your DNS, or the DNS for your area, is hijacked, and everybody who use that DNS is called up and told to log on to their bank in order to do something important?"

Evar heard of SSL certificates? Seems your bank as not.

Re:Solution: You authorise the bank first

[fbjon]

Ah, damn. I thought there was something missing in my scenario.. too quick to post :)

Re:Solution: You authorise the bank first

[Slipped_Disk]

> Okay, and how do the spammers get somebody's email
> address to start with? Oh yes, a virus emails the contents of
> their inbox to a russian server"

#1: Why a russian server? A little prejudiced?

#2: Use an IMAP server (preferably one running over a secure connection) like I do and don't store your email bodies on your local machine. Don't save your mail server password (oh is it REALLY going to kill you to type 10 characters?). Surprise Surprise, all they can get are headers unless they manage to break into the actual MAIL SERVER (in which case you have bigger problems than your winblows box getting a cold).

Re:Solution: You authorise the bank first

[Repton]

The problem is, that sort of thing only works with customers who have some awareness of security. This group of people are not likely to fall victim to a phishing scam anyway.

The target audience for phishers is more likely to either not notice, or to think "Hmm, the bank must have changed its security system. I'll just do what this link says and my money will be safer than ever!".

Re:Solution: You authorise the bank first

[syousef]

Mine once froze my accounts because they suspected fraud. (Some over zealous algorithm decided my spending habits had changed too radically one week). I got both a phone call (taken by my answering machine) and an email. I've never been asked for my username, password or credit card number though.

Re:Solution: You authorise the bank first

[hackstraw]

And this code would be sent through which secure email-delivery system exactly? Plaintext SMTP on the internet, like all the other emails from your bank?

I see your point, but _anything_ that is an indicator that the back actually knows you would reduce these phishing scams. They are generic, and the only thing that identifies th mail as being sent to you might be the "To:" field in the email, but that may also say something like "dedicated_customer@bank.com".

The ease in making this kind of scam profitable is that one well crafted form letter can be sent identically all over the internet. I bet these are profitable even considering that at best 90% or so of the people being phished don't even have an account with the bank they are posing as.

Re:Solution: You authorise the bank first

[ChumpusRex2003]

I get regular e-mail newsletters from my bank. And have, on occasion been e-mailed by them with account issues.

In the case of the account queries, the e-mail simply read something like 'Please can you contact Jennifer Bloggs on 0800 1234567 ext 123'

So I call, and wait for them to ask me my personal security question (none of this, 'what's your mother's maiden name stuff') - I'm expecting to hear something like, 'Of what strain was your first specimen of Felis domesticus?'

Re:Solution: You authorise the bank first

[Anonymous Coward]

Most of my spam comes from Egg.

Re:Solution: You authorise the bank first

[nospmiS remoH]

How about intentionally trying an incorrect password first? If it is your real bank you will get an error. If it is a scam it will look successful.

Re:Solution: You authorise the bank first

[el_benito]

I'm sorry, the acceptible terminology is "IntarWeb", but if you're President, we'll also accept "internets".

Re:Nothing to see here...

[clodney]

The FA didn't give any reason for why he thought the phish was targeted at him. Without an explanation, I'm sceptical that it was targeted in any way. I get phishing mails all the time - most commonly aimed at Citibank or Paypal, neither of which I do business with. I don't know why the phisher would bother to target them. Seems like more effort than it is worth.

Customer details

[metlin]

Limit access to customer records. This is pretty much standard practice in the banking industry anyway, but I found it eerie that my phisher knew what institution I did banking with. How did they know this?

Well, I've received several of these mails, but I do not really think they go by any kinda cue -- I've received mails from various banks from around the US, so I think these guys randomly see where you are, make a wild guess at the likely bank and send you one.

For instance, several students at GTech (where I study) have their bank accounts in a certain bank (which we shall call W) -- and a lot of these scams are directed at GT students pretending to be from W.

However, that said -- I'd not be surprised if they acually did some dumpster diving and found out these kinda details. Spooky, man.

Re:Customer details

[metlin]

Okay, I realized that I contradicted myself a little up there -- I meant that these guys don't go by any cue based on any serious evidence (like your statements or insider operations) -- they probably look up your e-mail address from your website or Blog or whatever, guess where you are from and use that information to target the bank you're likely to be from.

Because, I'd a page at which listed me as working in a certain lab that I used to work at - and some of these scams used to contain spoof elements of those banks, too.

Not to mention the eBay spams that I seem to be getting lately. Sheesh.

Re:Customer details

[moonbender]

That startled me, too. Phishers don't typically target individual users, they send out the same mail to every address they can get hoping that some percentage will actually have an account with that bank.

I've also gotten scam mails for various banks. The sophisticated ones took into account that my address is German (ends in .de), but I also get some for American banks. Some of the German ones actually got the institution right, but that's not too hard: there are a couple of really large names that probably cover about 90% of the German private bank accounts.

If there are more reasons to believe that they know more about him, he didn't mention them. The fact that they "got it right" the first time isn't enough, though, and I wouldn't be surprised if he gets more scam mails for other banks in the future.

Re:Customer details

[JuggleGeek]

they probably look up your e-mail address from your website or Blog or whatever, guess where you are from and use that information to target the bank you're likely to be from.

They probably don't do that much targeting. Set up the phishing site, send the spam to every address they can come up with, and hope for a few suckers, more likely.

Re:Customer details

[Anonymous Coward]

"a certain bank (which we shall call W)"

Wachovia?

They don't know who you are

[Space cowboy]

I must have got a dozen or so of these in the last few days, my spam appears to go in phases... either I'm in dire need of sexually-enhancing drugs, about to die from malnutrition, or they're all just after my CC details...

It's just a blanket 'attack'. Email is cheap, and they're not trying to be smart because they don't need to be.

Simon

Re:They don't know who you are

[theCoder]

I got one recently from someone who proported to be my phone company telling me that my bill was due in a few days and that I should go pay it online. It actually seemed legit because it had my phone number in it and it was to an email account I had given the phone company. However, the bill due date was wrong, and I had already paid the bill for the month. So I put it in the "deal with later" pile.

It wasn't until later that I realized that it might be a phishing scam. Further research indicated that it probably was, but I didn't get anything conclusive. I tried going to the website given (but not the random URL in the mail -- I didn't want to tip them off), but that just redirected to the phone company's site.

I did try to report the scam to the phone company, but I never heard back. They probably don't care.

What's scary, though, is that I didn't even think it might be a scam until much later. And I should know better. What chance to people who don't think about these things have?

ways to prevent online fraud?

[Anonymous Coward]

why not give consumers one time access (through pads)?
This is done in Japan and works well there. Maybe consumers here would lose their card? The card isnt electronic its just card with pin numbers that you scratch off each time you use the PIN number.

Banks should STRONGLY educate consumers to never expect emails from the bank that contain links.

Re:ways to prevent online fraud?

[LiquidCoooled]

I posted a comment a few days ago regarding how my bank secures online access.

The gist of it is a longer code that I arrange with them in person, and when I go online with them, they ask for random portions of that code.

I would have to be scammed multiple times before anyone had access to my banking.

The comment is here: http://slashdot.org/comments.pl?sid=128336&cid=107 16472

Re:ways to prevent online fraud?

[legirons]

"Why not give consumers one time access (through pads)?"

Ok, look at the story from the perspective of a real-world bank, rather than a mythically secure one.

There's a bank in the UK called cahoot (part of abbey national) which offers one-time credit cards that you can use over the internet. For those of us who use the same card for foreign pr0n sites, that sounds quite useful, right?

That's the smart bit. That was the good idea. Their security goes downhill for the rest of the story.

It's an unencrypted website, and the browser requirements are Internet Explorer 5 or later. From their email: "If you are using Netscape 6.0, you will not able to use the cahoot webcard". So, they require a known-insecure browser. I'm starting to have bad feelings already about their lack of clue.

To use the 'webcard' facility, you need to have Flash installed. The web-form isn't HMTL, it's flash. As most of us know, the encryption status of plugins on a page won't show-up in the padlock icon. Nor will it show-up when looking at the page's certificate.

In fact, their pages open in a new borderless window, so the security information, menus, and tools in your browser just aren't available. And like all popups, you have no real idea which website launched it. There's no URL bar, so even if you're using a non-Microsoft browser where the URL is trustworthy, you won't see it. It's a full-page flash animation, so no right-click menu to check who the page is.

Alternatively, you can download special software to access their website. "Currently, the cahoot webcard download software is not compatible with computers running Unix or MacOS." Uh-huh. Not compatible with MacOS? I think you misspelled "REQUIRES WINDOWS XP WITH IE6"

Oh, if you want a good laugh, email customer services. They have an email disclaimer like this:
Internet communications are not necessarily secure and may be intercepted or changed after they are sent. cahoot does not accept liability for any such changes. If you wish to confirm the origin or content of this communication, please contact the sender using an alternative means of communication."

Phishing alert anyone? Even the bank itself acknowledges that their internet-security is non-existant, yet they still use it!!! I think it was the cheek of demanding that their users take responsibility for their lack of security which astounded me.

Re:ways to prevent online fraud?

[fbjon]

What the hell? My Real-World bank gives me encrypted communications, works perfectly in any browser, although they recommend the lates version that supports SSL (obviously). Hell, they even say that if you're behind a slow connection, Opera would be the best alternative. The pages use Javascript, but don't require it. AND, I have a long list of one-time login passwords, complemented by a bunch of reusable confirmation passwords (that I could memorize if I really wanted, but they change with every list of login passswords). And the login ID is not connected to my name, my account numbers, or anything related to me, it is random, as far as I'm concerned. The server OS is BSD. So there. The only question mark is the server itself, Netcraft says it's running TANTAU Application Server/2.1.1. Googling for it doesn't return much, seems like a custom job... does anyone know what it is?

Re:ways to prevent online fraud?

[Anonymous Coward]

Pretty impressive -- almost 4 years uptime, running the whole place on a single BSD server?

Just looked at www.natwest.com for comparaison, and it's Windows 2000 with an average uptime of 5 days.

How to annoy phishers

[DrXym]

Drown them in noise. Everytime you get one of these emails, visit the site and enter bogus information. That's what I do. It might not be enough to get the scumbags caught but it must certainly be an annoyance to them. And who knows, a few bogus logins might be enough to get alarm bells ringing at the bank.

I reckon banks could do something similar too. Create some honeypot accounts, and track how the criminals attempt to access it. I'm sure they could play a few tricks with a seemingly big fat balance that could make the criminals reveal their hand.

Re:How to annoy phishers

[LiquidCoooled]

Username "PHISHINGSCAM"
Password "QUICKGETEM"
Name "CALL SECURITY"
DOB "01/01/1337"

This would be cool to try.
But tbh, I recon they would just take the list and try those that look legit.

What we could do is simply forward any phishing scam mails to a central phishing clearing house.
The banks could fund a small team to handle collective online fraud.

Re:How to annoy phishers

[LiquidCoooled]

Just below this comment a poster has given a link to a phishing central source :)

Looks like its already in action :)

http://www.antiphishing.org/

Re:How to annoy phishers

[DrXym]

In other words, make them look legit. Enter a well formed but bogus account / credit number, valid sort codes, expiry dates, names, PINs memorable dates etc. If you have an account with the target bank you could even ensure you enter an account number of the correct length and has the first four digits as your own.

The only way they have to separate the wheat from the chaff is to actually try them. If they're really stupid, they (or their underlings) may actually get caught when they attempt to withdraw cash or buy something. Now that would be funny.

Re:How to annoy phishers

[Sepodati]

Drown them in noise. Everytime you get one of these emails, visit the site and enter bogus information.

I've always wanted to find a way to automate that. Have a site where you could submit a phishing site, have it analyzed and then feed it a bunch of noise.

If it's all done from the same computer, smart people could weed out the noise by IP address, so you'd have to account for that somehow, too.

Once you make enough noise in the system, scams like this do not remain economical, I would think.

---John Holmes...

Re:How to annoy phishers

[sonicattack]

Enter a well formed but bogus account / credit number,

Today I got one of these fraudulent "the bank needs your information" E-mails. So, I thought, let's give them some noise to fill their log.

But the credit card number I made up was detected as non-existent - or at least the fake website said so.

Now, is there any way to:

1) Generate fake credit card numbers that pass as "valid"
2) Do this, and be certain that no-one actually owns that particular number, and if so, still not get into trouble?

Re:How to annoy phishers

[Anonymous Coward]

How much analysis do they do on the number? It's possible that they just set it to get rid of numbers that were anything other than 16 digits long.

Re:How to annoy phishers

[Threni]

> It might not be enough to get the scumbags caught but it must certainly be an
> annoyance to them

People say that about spammers. I'm sure they're annoyed with the millions they make from their activities.

The best way to avoid getting hit by phishers is to delete any emails that claim to come from your bank, paypal etc without reading them. And if they insist that they contact you via email rather than post, or via messages readable once you've logged on then I suggest you close your account with them and look elsewhere.

Re:How to annoy phishers

[throughthewire]

But the credit card number I made up was detected as non-existent - or at least the fake website said so. Now, is there any way to:

1) Generate fake credit card numbers that pass as "valid"

They're probably doing something trivial with Luhn numbers. Trivial to implement, trivial to spoof. Generating apparently valid but fraudulent card numbers is known as carding.

2) Do this, and be certain that no-one actually owns that particular number, and if so, still not get into trouble?

Trouble with whom? The scammers? If you aren't using the number to commit fraud, I wouldn't worry. We want to get the phishers in trouble!

Re:How to annoy phishers

[Anonymous Coward]

is there any way to:
1) Generate fake credit card numbers that pass as "valid"

The number is easy, but a matching name is virtually impossible.

Re:How to annoy phishers

[Repton]

They may also know what BINs they are looking for. The first six digits of your credit card number are the Bank Identification Number, which identify the issuing bank and (often) the type of card.

Some card generating products, such as Creditmaster, have a database of BINs as well as an implementation of the Luhn algorithm. Thus you can (say) ask for a random Bank of America Visa Platinum, rather than just a random 16-digit number that passes the Luhn check.

Of course, you need the expiry date on the card too before you can actually do anything, so all these flashy generators are not as much use as fraudsters would like :-/

If you want a Luhn-valid number that is not in use, you could try 1000 0000 0000 0008 :-)

Re:How to annoy phishers

[Anonymous Coward]

This is what banks should be doing "honeytoken" details given to phishers and get the people arrested that are on the receiving end of the attempted money transfers.

Some authentication should be reqired to pay INTO an account to prevent DoS.

Re:How to annoy phishers

[Anonymous Coward]

I'm pretty sure 9111 1111 1111 1111 works as well

Re:How to annoy phishers

[apdt]

Well, The algorithm for the OSCommerce cc check is as follows:

1. Remove any non digits from string.
2. Reverse the string.
3. double every second digit counting from zero (i.e first one gets doubled)
4. If a doubled digit is >= 10, add the 2 digits together (i.e. 12 becomes 3)
5. Add all the digits together.
6. If the result is exactly divisible by 10, then the card is valid...
...
...
8. Profit

Re:How to annoy phishers

[EnglishTim]

I've been meaning to make a little python library to make writing new noise scripts quick and easy. I get one of these phishing mails once every couple of days. I figure if I was quick I could drown their database in noise, especially if I made it pipe the requests through a random selection of public proxies.

If I ever get around to writing something like this, I'd be tempted to share it, but its power could be used for Evil as well as Good. Also, bizarrely enough, using such a program is probably against the law.

Re:How to annoy phishers

[SomeoneGotMyNick]

Slashdot moderators rejected an article I sent in over a month ago about this very concept.

A lot of times, you can send a URL encoded request (GET Request) to fill in bogus data from the address line. I've happliy sent random values to these seedy servers with a small bash script using lynx.

I suggested that one or more popular websites add a new 'banner ad' whose image location is a properly formed URL to submit a random value to a known phishing server. As people come by the site, a new request is sent to the phishing server on their behalf and floods the phishing server with bogus data coming from many locations. Of course, you may get a red X in the banner image, but who cares. Maybe have it a user optional response. The banner ad could read "Fight Internet Scams, Click here to vote."

Until such a time, I usually have fun overloading the form fields with typographic or unprintable characters well over the string length coded in the form. Hopefully, I cause havoc with their databases when I do that.

Re:How to annoy phishers

[rduke15]

If you want a Luhn-valid number that is not in use, you could try 1000 0000 0000 0008 :-)

Yes:

$ perl -MBusiness::CreditCard -e 'print validate("1000 0000 0000 0008"), "\n"'
1

But:

$ perl -MBusiness::CreditCard -e 'print cardtype("1000 0000 0000 0008"), "\n"'
Unknown

check out antiphishing.org

[enbody]

Check out antiphising.org

The wrost ones are...

[ScooterBill]

The EBay request to verify account information. I've received this several times. Perhaps the financial institutions don't do much because a small country in Africa isn't going to let U.S. law enforcement take care of the problem. Too much corruption is usually the case.

The maxim I always use is: The company that holds your account never needs to ask you for your password since they already have it.

Something many probably don't know is that your local police dept. probably has a high tech crimes unit. They will investigate and prosecute illegal activites like snooping around your company network. They can be very helpful.

Re:The wrost ones are...

[sonicattack]

The maxim I always use is: The company that holds your account never needs to ask you for your password since they already have it.

Eh, unless they want to verify that you know the right password, which is what these kind of scams are giving the impression of - a complete login page.

Re:The wrost ones are...

[jdkane]

The maxim I always use is: The company that holds your account never needs to ask you for your password since they already have it.

I would add: Often the employees of the company don't have access to the password because it is encrypted on their end. But the institution can change or reset your password without knowing the old password. This is usually preceded by a manual check performed by customer service over the phone to ensure you are really you. They might also ask you to come into the bank and provide ID.

Re:The wrost ones are...

[Anonymous Coward]

...your local police dept. probably has a high tech crimes unit
My local police department does not. They can't even follow the county procedures for tracking paper, much less create electronic records, much less actually figure out that something electronic is fake.

Enough Already.

[xanadu-xtroot.com]

Enough already with this "a blog entry says" stuff. Can we please get some ACTUAL news on this site and not just someone's rantings on a BB? Is that too much to ask?

Re:Enough Already.

[bob beta]

'ACTUAL' news, also known as Mainstream News, or MSM, is dying.

Hadn't you heard? Everybody else has. They cashed in so many chips in the recent election that people like Dan Rather may soon need training on the Fry Machine.

Re:Enough Already.

[Anonymous Coward]

I'm sure bloggers will go out of their way and risk their life in Baghdad to rant about how their breakfast tastes like shit after being fried by a bomb, or maybe it's easier to just post unverified rumours that you read on the Intarweb from your mom basement. Yep, mainstream news is dying, no doubt about that.

Re:Nothing to see here...

[LiquidCoooled]

I agree with you here.

Its just aiming at the big players to maximise your audience.
Currently, more people will fall for something like a Citibank scam than a LocalYokelTownBank scam.
Yes, there will be gullible people in both groups, but a lot more with the larger bank.

Hook, line, sinker.

Receiving too

[gmuslera]

in a mailing list I administer, and in my own personal address (time to test the new "report phishing" gmail feature) I received today what could be the same message, but the IP it pointed to resolved as ipvpn101156.netvigator.com (don't look like to be in zimbabwe) port 38, that looked like a Windows 2000/XP with too many open ports.

Probably that message is sent from hacked/owned/not patched windows machines that send the entered info to the real criminal. I suppose that for really knowimg who is him that "infected" machines should be hacked back or that the provider of that internet connection contacts/gives the address of the owner, and check the programs there.

Re:Nothing to see here...

[mat catastrophe]

Could be, yea, that he just feels "special" 'cause these cunning Zimbabweans just happened to guess his bank.

Which could also mean that they are netting fewer people than he thinks...except that there are really not that many small banks anymore.

With only a group of maybe five or six major banks in the US, I am sure it isn't too hard to snag some morons every now and again.

Is it that simple?

[Sarin]

I still don't understand, do these banks just give their customers a login/password for their account?

The bank I use gave me a little authentication device which combined with my bank card, my personal code and a random code provided by the bank site can generate digital signatures. In order to login and in order to make all transactions final I must provide the right code.
I've been using this system for about 10 years now, if those exploitable banks still use a normal password protection it's their fault they're exoploited this way and there's no way customers should be responsible for it.

Re:Is it that simple?

[Tim C]

My bank issues two codes, a registration code and an id code. These are used together with your card number when logging in, and you're encouraged to change them on first log in.

So, essentially I have two passwords, but they're both required to log in. I've not heard of any UK bank that issues anything like the authentication device you describe.

Re:Is it that simple?

[Anonymous Coward]

You'll have to remember that when it comes to banking, the USA is lightyears behind.
After all, they're still doing everything over checks.. ugh.

Re:Is it that simple?

[Anonymous Coward]

How is this any better? The phiser has you enter two passwords then. The OP's bank has a better method. Two-factor authentication. In your case the second password is static whereas the other guy's changes. You're just as insecure as us with one password.

Most Phishing Schemes Originate in India/China

[Anonymous Coward]

What the statistics do not tell you is that most phishing schemes originate in India and China. Especially since China does not have an extradiction treaty with the USA, there is no way to catch the bulk of the culprits.

Phishing schemes and junk mail go hand in hand. China is the king in terms of generating the most junk mail targetting North American Internet users.

The only way to stop the problem is the encourage American vigilantes to enter China and to go on a hunting expedition -- if you get my drift.

P.S.
The vigilantes could also kill a couple of Chinese thugs in Tibet. The Tibetans would certainly appreciate the help.

ROI

[Gary Destruction]

The scammer went to alot of work because the Return on Investment was so high. For a few hours of work, he probably a substantial amount of cash.

I Have Not Seen My Bank's Name in Phishing Scams

[mrs clear plastic]

I have used the same bank for over 15 years for my personal checking account.

I have not gotten one email from that bank (either legitimate email or a phishing scam with that bank's name or fake url.

That bank does have my email address.

I have gotten phising scams that have ebay in them (I do have an ebay account). I have also gotten phising scams with the names of other banks in my area.

I think they go by geographical data for banks. For ebay, it's no problem. They can scan ebay's pages and get seller's ebay account names with no problem.

Re:Nothing to see here...

[Anonymous Coward]

What the statistics do not tell you is that most phishing schemes originate in India and China. Especially since China does not have an extradiction treaty with the USA, there is no way to catch the bulk of the culprits. Phishing schemes and junk mail go hand in hand. China is the king in terms of generating the most junk mail targetting North American Internet users.

The only way to stop the problem is the encourage American vigilantes to enter China and to go on a hunting expedition -- if you get my drift.

P.S.
The vigilantes could also kill a couple of Chinese thugs in Tibet. The Tibetans would certainly appreciate the help.

Damn

[Glonoinha]

I misread the subject line on this article, thought it read Fisting for Phishers.
Now that is a punishment that would work pretty good, once word got out!

The problem is much larger than just banks.

[daperdan]

I work for a company that attempts to protect its customers from this kind of fraud. We monitor domain registrations to locate potential phishing scams. It's interesting to see that it's not only banks that are hit with this kind of scam. These guys will set up an entire shopping cart taking credit cards that mimick an online store like Dell. It's a pretty interesting scam that only seems to be gaining popularity.

It's not a major concern in the 3rd world so these guys have no reason to stop. We've seen scams like this based out of Russia, Brazil, China, and several African countries. It will be interesting to see how this all pans out.

Why is it so hard to catch these criminals?

[Anonymous Coward]

In order for them to get their ill gotten gains, they have to eventually withdraw some money from somewhere. It seems it would be trivial for INTERPOL or some other agency to set up a bunch of bank accounts with a few thousand dollars/euros in them and then start responding to all the phishers. Then just follow the money to the crooks. What's the big deal? Is there just no will to do this or am I missing something?

Cheers,

Re:Why is it so hard to catch these criminals?

[Tony-A]

Is there just no will to do this or am I missing something?

I doubt it's that easy or simple, but.
The authorities tend to be good at gathering and accumulating statistics.
The banks should also be concerned that somebody is using their identity fraudulently.
Savvy users forward the email with headers to such as abuse@citibank.com (which bounces, so there probably is no will to actually do anything about it).

Seems that if the authorities are to be able to do anything about it, they need lots of in-depth information so that the activities of the phishers are exposed as the activities are engaged in.

Re:Why is it so hard to catch these criminals?

[Daedala]

The money doesn't go to the criminals; it goes to a mule who thinks he's processing charity donations. Then it goes to another mule who thinks she's reselling computers. Then someone uses the cash to buy a plasma tv and send it to some other country. Then the recipient sells the plasma tv and wires the money to someone else..... The basic problem is money laundering, and we still don't have a good handle on that.

Re:Nothing to see here...

[Registered Coward v2]

I fell for a phishing scam once. I just hope when Mr Hitler tried to get a new password from tech support they didn't give one out.

Re:Stupid fuck

[natalia_hill]

Amen Brother Ben. Stupid fuckers, all of em.

Gmail vs. Phishers

[igrp]

It's definitely becoming more of a "mainstream problem". Afterall, the whole identitity theft problem is perfect Dateline/60 Minutes material.

Has anyone else noticed that the folks at Gmail have added a "report phishing" feature? When you view a message, click "More Options" and you'll see it.

Then again, maybe it's been there for some time and I just haven't noticed (it definitely wasn't there when I first got my Gmail account though and it doesn't appear to be listed as a new feature).

Slashdot this

[GQuon]

On a related note:
The lad vampire needs your help

Banks are lazy

[Anonymous Coward]

They could use the techniques suggested here but that's too much like real work. Or they could just stick it to their customers and make them prove it was fraud and even then just screw the customers over. As long as the banks aren't out any money, they have no incentive to do anything.

Here is a good rule of thumb: ignore them 100%

[gelfling]

Honestly how stupid are you people to fall for any of this. Absolutely do not respond to any request from anyone to provide any information for any reason whatsoever. Not even from someone who purports to be from the government. If anyone needs to get in touch with me that badly they can send a letter registered mail or have their attorney contact me.

Re:Here is a good rule of thumb: ignore them 100%

[npross]

Great advice if you are computer literate. You fail to realize that a very large percentage of computer users 1. Do not read slashdot and 2. Have no idea that they shouldn't trust the official looking emails they get. (If you recieved a physical mail on bank letterhead that said please visit your branch to confirm some details with your account, you'd probably trust it)

How exactly are these newbie users supposed to get the information that the web is different than real life? Watch the RvB PSA (yeah, my 60yr old relative is somehow going to see that)? Read the fine print on the banks website? These people religiously follow the exact steps they were shown, they are fearful of technology and are afraid to leave the "safe" path they have been shown.

Banks are rushing so quickly to push their users out of the banks and onto the internet without warning them of the dangers. They should shoulder some of the blame and fix the problem.

Re:Here is a good rule of thumb: ignore them 100%

[gelfling]

Nonsense. Before there were computers there were credit card companies and banks. If they called you up asking you to verify information they're supposed to have you'd be an idiot to give them that info.

There is little new under the sun. Just because we give it an incredibly lame 1337 name; "PHishing" doesn't mean it's not a hundred year old con game.

Also check out aa419.org

[GQuon]

Artists against 419 is also interesting. They are working against the phising sceems of 419 scammers.
If you've got bandwith to spare, be sure to check out The Lad Vampire

Please modify the news post and add one of those links. They could use the help of a lot of slashdotters, I think.

How do you drain an account without a trace?

[npross]

What monetary transaction can you make on an account that leaves no trace?

In every case getting cash out of my account involves paying a bill (to an authorized agent like VISA), or emailing money or transferring money to a 3rd party acct. All of these leave a trail that banks can recognize and plug.

I once changed my buying habits with my VISA card and had to confirm my identity before the transaction could be authorized. Since fradulent VISA transactions cost VISA, it appears that when it affects the bottom line, banks can and do put checks in to stop fraud, but there is no incentive for banks to stop fraudulent bahviour on behalf of their customers. (Of course we are no longer the banks customers, shareholders are the real customers)

Pressure needs to be applied to the banking industry to minimize the average person's exposure to fraud! It is easy to do, for example I should be able to lock transactions from my online banking account to a specific set of recipients and require a face-face visit with a banking representative to change this... Would-be fraudsters that obtained access to my account might be able to overpay my utility bill but that would be about it.

countermeasures?

[doginthewoods]

Just like spam, can we @ /. take any countermeasures? I'm not up on this stuff, so if I make a few silly suggestions, please give me a break. Pick a phisher /spammer and: /. them Send a reply with the name of a pop tune or movie in the title. Send a reply with a big attachment Send a reply with a virus attached If it's possible, think of all of on one day, sending an email with "White Houses" on the title, and a 4 Mb attachment to a spammer / phisher. A toasted server, maybe?

Re:countermeasures?

[YouHaveSnail]

Pick a phisher /spammer and: /. them

So you're advocating a distributed denial of service attack on somebody's server?

An actual phisher would undeniably deserve such a treatment and much more, but that doesn't make it okay. But what if you make a (gasp!) mistake? You could be asking thousands of Slashdotters to participate in a DDoS attack against someone who might be completely innocent, or whose only 'crime' is that their own server was compromised and used by the real phisher.

What you're talking about is vigilante justice. It's illegal, and reasonable people don't engage in it.

If you want to do something about phishing, make a stink about it with your elected officials, government agencies, your ISP, your bank, etc. If you don't have time to do all that, just do some. The issue won't gain traction until enough people start talking about it.

Re:countermeasures?

[Anonymous Coward]

Get a fucking life and stop accusing the man on the street of a crime when all he is interested in is safely stopping a crime in progress.

This isn't vigilante justice. A web site that is up, running, and is a financial danger to grandmas everywhere MUST be taken down. A web site that is up, running, and compromised MUST be taken down.

People lose thousands of dollars by such sites - and most of those people dnt have thousands of dollars to piss away. And you think it is acceptable to let them operate?

Contacting elected officials won't help. Contacting your ISP won't help. And good god, contacting your bank won't help.

If action against these guys isn't IMMEDIATE, regular people will lose. Maybe only 5 or 10 people will lose - but that could very easily be 5 or 10 life savings.

Get a life and post only when you have something useful to say.

Re:countermeasures?

[Slipped_Disk]

This is most certainly vigilante justice, and it is most certainly illegal. What people like you who want to go around DOSing phishing sites off the web seem to forget is that there are OTHER PEOPLE using the SAME BACKBONE.

When you can't get to www.pornopalace.com or whatever sites you like to visit every day because there just happened to be a phisher in the same co-lo, and a bunch of vigilantes decided to DOS that phisher off the net to protect the innocent (and the stupid), or when your personal site is knocked off the net for the same reason, you'll sing a different tune.

And that's to say nothing of the small web hosting providers (there ARE some of those still around ya know) who unknowingly sell an account to a phisher. They'd probably be more than happy to take the bastard's site down and keep his money, but by DOSing the phisher you wind up costing the poor hosting company money (remember, SOMEONE has to pay for that bandwidth you're using up with your DOS attack, so when that $9.95 a month website you're enjoying becomes a $19.95 a month site and they say it's to cope with "excessive bandwidth charges" don't come crying to me).

This is NOT the old west. The 'net is NOT a vast untamed frontier where you can just go taking down sites you don't agree with anymore. This is the REAL WORLD and in the REAL WORLD your ACTIONS have CONSEQUENCES.

THINK before you speak or act, or better yet, just STFU until you can say something useful.

Mod me however, I've got freakin' karma to burn.

Re:countermeasures?

[YouHaveSnail]

This isn't vigilante justice. A web site that is up, running, and is a financial danger to grandmas everywhere MUST be taken down. A web site that is up, running, and compromised MUST be taken down.

So, who decides which web sites MUST be taken down, and which may be allowed to remain? You? Oh, I see. And this differs from vigilante justice exactly how? Let's take a look:

a member of a volunteer committee organized to suppress and punish crime summarily (as when the processes of law appear inadequate); broadly : a self-appointed doer of justice

Mmm, yeah, just as I thought. It differs not a bit.

Look, Anonymous Coward, if you condone taking any web site out based on nothing more than your own opinion, you open us all up to the same sort of action from others. Someone will shut down your favorite porn site because goodness, think of the children! Infidels.org will be taken down by a DDoS from Christians Without Reason. Shortly after that, coke.com will be taken down by PepsiCo. Nothing will be safe.

Let me be clear: Encouraging a DDoS is vigilantism. There are other ways to deal with the problem. Dissatisfaction with the other options is not an excuse for descending to vigilantism.

Re:countermeasures?

[Anonymous Coward]

Infidels.org will be taken down by a DDoS from Christians Without Reason.

Woah, no one here advocated taking down infidels.org, and no one described how to determine what makes an illegal phishing operation. However, people here have advocated taking down illegal phishing operations that pose imminent danger.

To draw a parallel, your writings suggest that you would let your neighbor be raped by a thug in the street. After all, maybe she's into that faux rape thing that you see on "your favorite port site".

Hopefully that's not the case. Hopefully you'd take some action above and beyond going home, calling 911, and waiting 15 minutes or more for the police to arrive.

Re:countermeasures?

[flonker]

I have a serious ethics question. Assume I have a tool that I wrote. It generates false account information and plugs it into a scammer's form repeatedly. Logically, if the scammer receives enough invalid responses, they won't be able to filter out the valid accounts from the invalid accounts. Also, the collateral damage is very limited - a trickle of bandwidth. The targets (phishing scams) are easily identifiable. And regular law enforcement has shown to be extremely inneffective in stopping this kind of activity.

Is it justified to use this tool? And why/why not?

Assume that I've used this tool, and the scammer blocked my IP address. Is it justified to use this tool through open third party proxies? Again, why/why not?

Any responses would be appreciated.

Re:countermeasures?

[Anonymous Coward]

You are not justified to use the tool.

Only if a court of law determines if the site is illegal, AND that court of law explicitly permits you do perform a damaging act of personal violence against the website in question may you use your tool.

How do you know the site is a scammer's site? Maybe Citibank has an experimental site, or someone has created a mirror of their site for convienence. Or maybe it is a legitimate proxy site. YOU CAN'T TELL! And just because you received a scammer-like email about it doesn't mean it is legit - maybe the scamming emailer wants to bring down the site due to political or personal motives.

Anything else is clear vigilantism.

Re:countermeasures?

[YouHaveSnail]

To draw a parallel, your writings suggest that you would let your neighbor be raped by a thug in the street. After all, maybe she's into that faux rape thing that you see on "your favorite port site".

Hopefully that's not the case. Hopefully you'd take some action above and beyond going home, calling 911, and waiting 15 minutes or more for the police to arrive.

Yes, of course I'd intercede if someone were in direct physical danger. I'd also take action if I saw someone about to reply to a phishing scam.

However, if I saw someone who looked like a thug walking around the neighborhood, I don't believe I'd be justified in organizing a dozen of my friends and beating the crap out of him.

Re:countermeasures?

[NaDrew]

You could be asking thousands of Slashdotters to participate in a DDoS attack against someone who might be completely innocent, or whose only 'crime' is that their own server was compromised and used by the real phisher.

... or that their server is hosting a site linked on Slashdot. Same effect.

How is it possible to make money?

[Futurepower(R)]

How is it possible to make money, knowing the login name and password for a bank's customer? The only actions allowed are transferring money from one account to another, ordering new checks, and finding the check amounts and account balance.

Re:How is it possible to make money?

[stoborrobots]

The only actions allowed are transferring money from one account to another

Like from your account to mine...

Re:How is it possible to make money?

[russint]

Like from your account to the estonian bank account that the scammer set up using fake a id (just clarifying).

Re:Nothing to see here...

[jobugeek]

Funny you mention that because just the other day I got a scam email posing as Citibank. About 30 seconds later, I got one from some local bank in North Carolina. I guess they are trying to cover all the bases.

Transfers are between your own accounts.

[Futurepower(R)]

You can ONLY transfer money from one of your own accounts to another of yours.

Re:Transfers are between your own accounts.

[stoborrobots]

Which bank does not allow you to make payments to other people? What is the point of online banking if you can only shuffle money between your own accounts.

Of the four banks with which I have bank accounts, all allow me to make payments to anyone else whose account details I know. I can also make SWIFT (i.e. international) transfers to any account worldwide, by providing branch SWIFT code and account number.

Re:Transfers are between your own accounts.

[Eggplant62]

Where I bank, the online facility allows me to write a check to anywhere I damned well please. *That* is what scares me about these bank phishers. There are too many gullible sheeple out there that would fall for it and end up with empty bank accounts.

Re:Transfers are between your own accounts.

[HermanAB]

In Canada, you can send money by email from your bank account to almost anyone else in Canada. Most banks subscribe to this service.

Idiots looking to make a quick buck, that's who.

[wantedman]

It's amazing what people will do for you for some cash.

My friend's paypal account was ripped off. A 3rd party bought a camera and shipped it to Russia, because the auction's shipping was only avalible in the US and the Russian wanted the deal. The Russian supplied my friend's paypal and a $20.

The camera is safe in Russia while the idiot who bought it had a chat with the police.

I am a victim!

[ljavelin]

I am the recent victim of a scam.

OK, not a victim. Let me restate: I am the recent victimizer of a scammer looking for a victim.

And I have a new $3000 to prove it. Sent to me directly from an "honest businessman" from Nigeria. Really. It was FedEx'd from Nigeria. From a guy named Walter Nabanu.

OK, I don't have a new $3000. But I have a check that says it is worth $3000. But I'm not going to cash it.

How much does it cost to Fedex an envelope from Nigeria to the US?

At least FedEx made out on this deal.

Re:I am a victim!

[YouHaveSnail]

All my posts have the "sarcasm" volume turned up to high. Read as "this is a joke".

OK, not a joke. Let me restate: despite significant evidence to the contrary, I continue to think that I am clever.

What worries me

[Al Al Cool J]

Is the day that some phisher gets control of an ISP's name server, either by hacking it or by being in cahoots with the ISP. They could then redirect somebank.com to their own server, and just sit back and let all the unwitting victims come to them. Throw up a "service not available, try again later", message after login, and the victim would leave, totally unaware.

What would be the best way to protect yourself against this? Is it possible to set up caching DNS to pool from multiple independent sources and either alert on conflict or resolve by majority rule?

Re:What worries me

[ettlz]

Genuine banks' web-sites should have digital certificates signed by known authorities (Verisign, etc.). If I know my authentication schemes correctly, this signature is nigh-on impossible to forge (one of those "mathematically hard" tasks). Thus, even though the name resolves to a bogus server, the certificates don't add up. To make a convincing effort, a phisher would need access to private data from within the on-line bank's systems (i.e., run an inside job).

Although I might be wrong on this...

Anti-phishing solution

[overThruster]

This is not true:
>a Gartner analysis is quoted as saying "What's
>really scary about it [phishing] is right now there
> are no back-end fraud detection solutions for it."

Corillian Corporation provides an effective back end solution that is capable of detecting phishing sites as they are being built:
Corillian Fraud Detection System

Re:Here is a good rule of thumb: ANNOY them 100%

[Concerned Onlooker]

I only ignore them if I don't have enough time to fill out one of their forms with some incredibly bogus and insulting information.

Why do I never get Phished?

[peccary]

I have about a hundred email aliases that I use on a regular basis (for spam control - so I can see if any of my vendors divulge my address).

I have made numerous postings to Usenet and public email lists with some of those addresses.

I have a few email addresses in mailto: links on web pages.

I have about five times as many credit cards and bank accounts as the average person.

Some of my email aliases are six years old -- I don't think that any of my email addresses from > six years ago still forward to me.

I never get any of these phishing emails. I can't remember the last time I received an email virus/trojan/worm. I get a fair bit of spam, but it's manageable.

Am I living in a different universe from the technology journalists?

Re:Why do I never get Phished?

[Teun]

Am I living in a different universe from the technology journalists?

Clearly.

I have one adress that's about 6 years old, use(d) it everywere, and it gets regular esp. 'Ebay' queries.

Some remarks...

[tradervik]

I have a fair degree of familiarity with this issue and have some comments on the blog entry.

Limit access to customer records.

There's almost zero chance the phishers knew the author had an account at his bank. They use spamming techniques and count on getting lucky.

Financial Institutions could automate the process of identifying where their logos and site images are used as a standard practice of trademark enforcement.

Some financial institutions already do this but it is very expensive. Despite the dire headlines, current levels of fraud are not high enough to justify the cost in many (or most) cases. This is also why financial institutions in North America do not use two-factor authentication such as token cards. I've seen some clever ideas for cheap two-factor auth. that might work out.

FIs, and other organizations, should pressure ISPs (AOL and Comcast especially) that deliver email on their networks to mark these emails as fraudulent.

I think it would be more effective if consumers put pressure on browser and email client software suppliers to fix the security holes in their applications.

highly sophisticated phishing sites would require that the phisher have a banking account

I find it very doubtful that phishers would ever have an account at the instituion whose clients they are attempting to defraud. First, there is no need to get access to authenticated pages to create a "highly sophisticated phishing site". Second, the act of opening an account requires providing proof of identity and would create evidence that could lead to finding the real identity of the phisher.

Banks should actually follow-up on reported phishing attacks.

This is bang on. Not following up on the author's email is a pretty big mistake.

Sometimes, when the public tried to assist...

[deunan_k]

Based on this experience, I now honestly believe that 5-15% of all recipients of this email could easily have fallen prey to the scam. I documented all the information collected and emailed the scam hotline of my bank .

Yeah, it happened to me many times.. The first time (way back in 2003), I too documented everything, even went so far to do a reverse IP, full e-mail headers, checking the geographical location of the IP address (turns out to be Korea, land of mass broadband penetration) and even incl. a snapshot of the display output. What do I get in return?

The bank e-mailed me back advising not to click nor believe the mail that I got originally. Hello?? I've done half of the work for you trying to assist in catching these bast**ds, and I know that it's a clear blatant fraud case.. What do you take me for? Sometimes I don't believe the kind of idiots they employ.. Can't they understand english? And these guys are supposed to be the country's largest commercial bank!!

From that moment on, I'm not gonna do their work for them, I find it easier to press the delete key/include in my shit list/configure my spamfilter.. Well, at least not for these idiots anyway..

Peace of mind

PS - I noticed that since most of the scams (at least on my side) originates from Korea, I wonder whether it is the work of North Korean agents trying to scam money in order to generate cash in order to funnel it back to ol' Kim?? Nah... I've been watching too many kung-fu movies..

clamav

[Anonymous Coward]

clamav will find and bust a lot of the phising e-mail as viruses. - works great.

draz

Readable version

[Anonymous Coward]

http://shit.slashdot.org/article.pl?sid=04/11/07/1 519251

I'm so disappointed

[gone.fishing]

Every time I get a phishing scam, I contact the affected bank's security department providing them all of the information that I've developed. In many cases this is made extra difficult because the only method they provide of contacting is a web-form. With these, I have to cut and paste the headder info and so on. It really sucks.

Usually, no matter what the method of contact, all I get is an email reply with boilerplate info telling me how to protect myself against these scams. This is utterly stupid, I've already taken action that shows them I am aware of what is happening!

After a week or two I always follow up. On the few occasions where I recieve a human reply from this follow up, I am told they can't provide me with information on an on-going investigation. I know BS when I see it and these replys are BS.

I'm trying to do the banks a favor yet apparently they view this as more hassle then help. Apparently they don't do anything unless someone actually loses something (and maybe not even then, I wouldn't know - I've never fallen victim).

I'd suggest that the banks rotate their images in a public folder changing the real image with ones that say You are visiting a scam site if you are seeing this image. That would slow the phishers down or make them do some real work at least.

Re:I'm so disappointed

[bedessen]

I read an article once by someone familiar with security/fraud divisions of large banks and the like. (Sorry, I can't seem to find a link or reference at the moment.)

But essentially the gist was they need the fraud to occur in order to do anything about it. Their entire machinery for dealing with fraud requires that it has already happened, i.e. the money has changed hands. They start to act after the fraudulent transactions have been processed. Apparently they need that amount of concrete evidence in order to investigate further and work with law enforcement. So, when you report "hey, this website is trying to phish your customers" you are naturally going to get the silent treatment, a virtual shrug, because they don't give a crap until the fraud has taken place. Basically they have decided to be entirely retroactive and fight the fraud from the perspective of "mopping up after it's happened" and are entirely uninterested in trying to investigate web sites, domain name registrations, open proxies, etc. If you report a phishing scam, they are going to need records of the bad person logging in to your account you and removing your money -- they just aren't interested in looking into it until that point.

Re:I'm so disappointed

[flonker]

So, the solution is to open a bank account, put a minimal amount of money into it, and give it to a phishing site? Use a corporation or an LLC to keep your personal life as unaffected as possible. Of course, at that point, they'll probably require a minimum amount of damage, and I'm not willing to risk $25k on this type of endeavor.

I get a few phishing spams a day

[francisew]

I'd say that I see at least 3 financial institution phishing scams each week. I have never had a single scam in the name of my bank. Over all, I think I have seen phishing for information for about 10-15 banks. Seems likely to me that the blogger simply got unlucky with having his own bank targeted (or maybe the phisher just got lucky).

Re:fake credit card numbers

[rduke15]

1) Generate fake credit card numbers that pass as "valid"

Easy: Business::CreditCard - Validate/generate credit card checksums/names.

poisoned DB attack

[BlueJay465]

I think there is a simple solution to this. If you are fishing for phisherman and as soon as you find one, fire off a script that will insert bogus (but legit looking) information. Say they had a DB with 90% of the entries were valid info from their victims, you could poison their database down to 20% correct quite easily, and they will either have to scrap the whole thing or risk getting nailed by International authorities for fraud when they try to use the false info, repeatedly (which they will of course, criminals are hardly the smartest people out there).

A lowly consumer may not have much clout in getting this scum off the bottom of their shoe, but the banking industry itself has a helluva lot more leverage.

Re:poisoned DB attack

[Anonymous Coward]

Enough talk about poisoning the DB, somebody needs to write a script to DO this. I know plenty of people who would LOVE to leave a poison script running.

Pardon the thought,

[TO11MTM]

Pardon me for saying this... Because it is absolute flamebait, but... Tracing a lot of these e-mails show that they are hosted on Russian websites... Between the Possibility of Sobig coming from a Russian company... The fact Coolwebsearch is from a Russian company... And these phishing e-mails... Why DON'T we delink them?

Re:Pardon the thought,

[Slipped_Disk]

A simple, serious answer to your simple, but not really serious question: We can't.

Delinking any large portion of the net now is difficult if not impossible, since the DoD no longer runs the show. Commercial backbone providers in Europe will continue to operate however they wany, and if the Russians pay their bills on time the packets keep flowing.
Ditto for Nigeria and other (in)famous scam countries.

The amount of effort required to delink any node or set of nodes makes the operation time- and cost-prohibitive, since thanks to the wonders of routing if even one path remains open all the traffic will eventually be funneled over there. (Of course this COULD result in all of Russia's traffic going through a 14.4 modem somewhere in Siberia, which would certainly make things quite interesting and would effectively knock them off the 'net, but that's purely an academic comment :))

This has been a public service announcement by Blinky the Three-Eyed Phish.... er, fish :)

Re:Stupid fuck

[Anonymous Coward]

Despite what's written in the First Amendment, you still say this country was founded on "Christan morals", which supposedly includes denigrating people who don't fall within your narrow little worldview, and making them INFERIOR from a LEGAL perspective?

Whatever happened to "love the sinner, hate the sin"? By putting such things as anti-gay-marriage rhetoric into public policy, you are FORCING YOUR RELIGIOUS BELIEFS ON EVERYONE. You are doing the exact OPPOSITE of what God teaches, by taking away the free will that He gave us. If a person doesn't have FREE WILL to choose or not choose to believe in God (and that also includes morals that boil down to a solely religious belief, with no legitimate secular reasoning behind them), then any choice that person makes is worthless.

I'm a Christian, and I support legal rights for gay couples, that are equal to the legal rights of a straight couple. Whether you actually call it 'marriage' or not, I could give a fuck less. We have no right to prevent someone else from doing something just because "God said it was wrong". Make that decision for yourself, not someone else, dickhead.

You are right.

[Futurepower(R)]

You are right. It is possible to ask the bank to turn off bill pay, but it is normally on.

if you use this once, is it then compromised?

[Anonymous Coward]

And if the code is used once then it can be compromised because you have to view it.

Someone could have a camera pointed at your monitor and they would then know your Seeecrreet code.

On line banking is not and never has been safe.
It is dangerous. But so are a lot of other things too.

I don't think the risks are worth it for on line banking.

Re:Stupid fuck

[Anonymous Coward]

50 million people voted for decent Christian morals which this country was founded upon.

A particularly funny statement given that the founding fathers of the U.S. were, for the most part, not Christians as we currently think of Christians.

easy

[Anonymous Coward]

and if you don't know I won't tell you

HTML Email

[R.Caley]

Is evil. Don't read it. Persuade your friends not to read it. If someone legit sends you some, reply asking them to re-send in a sane format, explaining why.

It's a slim chance, but if enough people get irritated enough from having to re-send enough email, then perhaps we can still get rid of this idiotic idea.

phishing works...

[Anonymous Coward]

it's a matter of scale. The hundreds of people who don't respond are made up by the few who do. In a couple of days, a decent site can collect 4 or 500 sets of information.

Those of you who wonder "what the hell can someone do with my online banking information" are not thinking creatively enough. The scammer doesn't care about being able to login to your online account (although that is a tasty extra). What he cares about is the other information you provide which enables him to call your credit card company up, change the address and phone number associated with your card, and either order a new card to the new address, or simply use your number to order products. This is the time tested method, and it continues to work well while banks continue to allow this level of access to accounts with only a mother's maiden name and social security number. The phisher collects more than enough information to do this.

The thing is, these people don't "drain your bank accounts." That process is impossible for all but the most stupid banks (such as citi, which allows online wire transfers). Instead, they use your account as you would, to make purchases of goods for resale.

It's all pretty simple if you think about it a little bit. Or know those who do it themselves...

I autohrise them, and they email me!

[hadaso]

By bank does send email alerts, but they never include any useful information. Just a notice that I have a new alert and a link to the "alerts" section in their website.

But that's not what I really want to tell you. There are ways to (at least partially) "authorise" your bank (or anyone else) to send you mail). I gave my bank a SneakEmail address that forwards the bank's mail to me, so any email from my bank has to come through this address, that is not published. The probability that a phisher can randomly produce it is very low. The only thing you need is an unpublished address that's very unlikely to be forged, and you can then have a reasonable level of sender authentication.

Now if this is not enough, consider VarA ("Verified And Recipient Authorized"). The details are not really important. The idea is that existing sender identification schemes can be used with unique recipient addresses: so say your bank published an SPF record (not that I endorse SPF as an anti-spam technique...). Then you can give the bank a unique email address, and then whenever email is received for that recipient address your server makes an SPF query on the bank's doamin name: the receiving address triggers a check that the email came from the allowed sender's domain. To be able to do that you'd need server software that does it, but then it's all doable on the recipient's side, no need for sender's cooperation. The sender just sends email to the address the intended recipient provided. No interoprerability issues. Anyone who wants to implement it on their servers can do it now, and there's no need for unifirmity: in fact, diversity in the way it is implemented is an advantage, as a uniform implementation is a bigger target for those who would want to circumvent it.

Getting Banks to Advertise SPF on their email

[billstewart]

One critical thing to do about Phishing is to get Banks, E-Bay, e-gold, etc. to publish SPF codes for their email servers. That would permit any ISP or end user whose spam filters support SPF to discard most of the Phishing mail unseen, rather than depend on the user to notice that it's fake. Digitally signing email is also important, but at the moment SPF is more useful for most people, since Joe Gullible isn't going to validate signatures anyway.

How I silenced phishers FOR GOOD!

[iamcf13]

1) Configure all e-commerce sites you do business with to send you ONLY PLAINTEXT EMAIL--NO HTML!

2) Filter out ALL HTML email sent to your e-commerce contact point email address. I use my own program to do this automatically for me.

Without the cover of HTML, phishers CANNOT use it to fascilitate their desception.

I used to enter bogus info at the phish sites but I gave up as they seemed to be keeping records and I cannot use a particulare (presumably) 'bogus' credit card number against them. Now I just delete all HTML email (phishing included) that is sent to my e-commerce contact email address.

Mostly, yes

[billstewart]

Some banks get fancy and use SecureID or similar access tokens, but most US banks seem to only use login and password, and it's not uncommon for the password to be your ATM PIN.

No

[rduke15]

I'm pretty sure 9111 1111 1111 1111 works as well

$ perl -MBusiness::CreditCard -e 'print cardtype("9111 1111 1111 1111"), "\n"'
Unknown

$ perl -MBusiness::CreditCard -e 'print validate("9111 1111 1111 1111"), "\n"'
0

Fun Scammer Bandwidth-Burner aa419.org

[billstewart]

The Lad Vampire is a project of Artists Against 419 which has taken down ~150 scammer websites. The scammers tend to have lots of websites out there for their fake banks, and they're usually cheap and disposable and typically have monthly bandwidth limits. The lad vampire page shows images from 20 or so of the sites, and keeps refreshing them rapidly until they've burned the monthly quota (after all, a few hundred people with DSL lines or cable modems can use a lot of download bits.) When one scammer fake bank site dies, they replace it with a new target.

There are more efficient ways to implement this - a script that keeps doing "wget options > /dev/null" could suck down as much bandwidth without wasting CPU and memory on having your browser render it, but this one's really a no-brainer to use. One of my computers gets a bit clunky running this (the 2.4GHz running XP has more trouble than the 1.1GHz running Win2K.)

Don't go to Nigeria to pick up your money

[billstewart]

Turns out the 419ers have a fair amount of practice gang-banging on their own.