How the Phishing Biz Works

Carl Bialik from the WSJ writes "Christopher Abad has spent much of the past six months 'stalking the phisher underground,' Lee Gomes writes in the Wall Street Journal. 'The typical phisher, he discovered, isn't a movie-style villain but a Romanian teenager, albeit one who belongs to a social and economic infrastructure that is both remarkably sophisticated and utterly ragtag. If, in the early days, phishing scams were one-person operations, they have since become so complicated that, just as with medicine or law, the labor has become specialized.' For instance, a phisher in Romania who successfully scores account information for someone in the U.S. may go on IRC to seek out a 'casher' to withdraw money from the target's account, and send a cut back to the phisher."

Comments

Almost as informative...

[sandstorming]

But not as prettyful as... This Technology

Movie style villain

[usernumber31337]

"'The typical phisher, he discovered, isn't a movie-style villain but a Romanian teenager"

A Romanian teenager is a typical movie style villain. Haven't they ever seen Blade?

Re:A real person phished

[Otter]

I understand the "How could anyone be stupid enough to fall for this?" response to Nigerian email scams. But phishing? Maybe you don't get the good ones, but it's next to impossible for even a relatively sophisticated user to distinguish them from authentic emails. I deal with phishing by deleting everything purporting to be from EBay or PayPal -- I sure as hell wouldn't trust my ability to safely follow links from any of them.

"What?" shriek the Slashbots, "If hot Brazilian chicks can't view the message HTML, traceroute the links and the redirects and WHOIS the resulting information, they shouldn't be allowed to use computers!" Perhaps, and perhaps me neither, but it doesn't surprise me that people get burned.

Re:They have the public..

[leonardluen]

no, the problem is that when you put a person at a computer their intelligence drops 10 fold. they just seem to lose all common sense when a computer is involved.

for example, if a random stranger walked up to you on the street and said that they were a representative from your bank and said that they must verify your account information otherwise they will have to close down your account, you would tell them to fuck off, walk away, and maybe even call the police on them. now, that same person gets an email stating the same thing that the stranger on the street said, and suddenly they worry that "OMG i need to give this strange person all my data or they might close down my account."

they just need to learn to delete and ignore their email, similar to how they would have walked away from the stranger on the street.

Stereotype

[williamhooligan]

"The typical phisher, he discovered, isn't a movie-style villain but a Romanian teenager, albeit one who belongs to a social and economic infrastructure that is both remarkably sophisticated and utterly ragtag."

This is a vast exaggeration. The image of an eastern europe, 'ragtag' social and economic infrastructure is, for example, in complete contrast to the well-dressed, hip, bling-bling superstars that make up my crew.

We call it Fly Phishing.

Re:IRC Cashiers Karma

[emmons]

We destroyed their way of life

How so? Their way of life didn't work and the system imploded on itself. Granted we did all we could to speed the process, but we weren't the cause.

meta-phishing

[samkass]

"Hello, I am a Nigerian 'phishing' hacker who steals money. But I have no way to withdraw the money from the accounts I've collected. I will give you an account number containing $50,000 in exchange for $1000 pre-paid into my account. Once I verify the money is in my account, you will receive instructions for how to access the $50,000."