Slashdot Mirror
3.2 Billion Dollars Lost to Phishing in 2007
mrneutron2003 brings us FastSilicon's summary of a Gartner survey which found that 3.2 billion dollars were lost in 2007 to phishing scams. "Gartner's latest survey into the realm of phishing attacks paints a rather bleak picture for 2007, with a record estimated loss of $3.2 Billion (that's Billion, with a B) U.S. Dollars. Overall loss per incident fell (to $886 from $1,244 lost on average in 2006) but the numbers of individuals who fell victim rose quite sharply from 2.3 Million in 2006 to a staggering 3.6 Million. Though online portals Paypal and eBay remained the most spoofed brands, it appears phishers are getting more creative utilizing fake electronic greetings cards, foreign businesses, and charitable organizations in their attacks on consumers. Furthermore these criminals are increasingly targeting debit card and banking credentials rather than credit cards, because the fraud protection mechanisms there are far weaker, according to a study done at The University of California at Berkeley.
Oh, and those of you who don't have Ultra-Slashdot, just send me your e-mail address, your Slashdot password, and your credit card number (just for verification), and I'll be sure to enable it for you...
Lawrence Person (lawrencepersonh@gmailh.com (remove all "h"s to mail)
http://www.lawrenceperson.com/
$3,200,000,000 isn't chump change. This is an organized effort.
Are these people that good? Is it that hard to follow the trail?
Do the companies care that their consumers are being duped?
No. Really. Have you ever hit up paypal or ebay regarding a fraudulent transaction? Nothing usually ever comes of it. Why think that they will change now?
It could be worse, it could be Monday.
But don't the criminals still get the money, regardless of which type of account from which they steal it? Why do they care either way about better consumer fraud protection (which I read as "responsibility for unknown charges")? Or is it that credit cards have better preventative measures? I RTFA, but couldn't find where Berkeley talks about why credit cards have better fraud protection.
Also, as an anecdote, my bank/debit card company did very well to prevent an instance of fraud with my account. I'd like to know what credit card companies do so much better, other than the fact that they're not able to hold you personally liable in cases of fraud and thievery for amounts over $50 (?).
Please don't use "umm" or "err" or "erm".
Get yourself a disposable credit "debit" card from any discount store (Wal*Greens, etc). GreenDot is very popular with the black market types. You can even use it on gambling sites, supposedly.
The best part of the disposable cards is that you can cap the spending without fees. If you're buying something for $500, put $500 on it, and don't refill it. A few times a year they have deals where the cards are free as is the first deposit, so pick up a few grand worth of them at various levels and you're set.
From what I know of the people who use them alot (google Rosemont, Illinois), they're also a great way to exchange money without anyone tracking it. Just what I've heard, though.
I've been saying for a while, phishing is a far bigger problem than spamming. The attach rate is a lot higher, because people think they are responding to a genuine email from Bank of America, the rewards are orders of magnitude higher, because you can take all their money, while the costs are just a bit higher. Sure, its slightly illegal, but to be honest, that clearly has no effect.
That all depends on your bank. I got my debit card duplicated and somebody took $500 out of my account. The bank called me up before I even noticed the money was missing. They asked if I made the charge. I said I didn't, and the money was back in my account within 5 days. I had to go down to my local branch and pick up a new debit card, but there was very little trouble on my part. Just as a reference, my bank is TD Canada Trust.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
I feel this is largely parallel to the stories and discussions we've had on the economic basis of spam, and the comments I've made on the economics that drive others to cover for the criminals.
Many of the phishing emails I have seen tend to use domains that are creatively re-arranged to look like the real thing - something like paypal.com.evilphishingdomain.com to substitute in for the real paypal.com. And of course, the evilphishingdomain.com was willingly sold to a crook by a registrar who themselves are of less-than-stellar reputation.
Just as I've said before regarding spamming domains, if there were better controls on the domain registration process, a lot of this could be reigned in. Sure, some phishing emails do go by IP addresses instead of domain names, but for the large portion of them that use names instead, we can shut down their game quicker by making registrars actually give a hoot about their customers' damage.
The Malware Economy Evolves (slashdot article)
Comments on Malware Economy
The Economic Basis of Spam (slashdot article)
Comments on Economic Basis of Spam
My journal article on the registrars' role in keeping spam alive
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I can't wrap my mind around it, but it seems that there is some relationship to this phenomenon and that of $7.8 Billion in unused gift cards (just this year!!)
The end result is the same, some group (in this case retail store executives) is getting billions of dollars in exchange for exactly nothing.
while [ 1 ]; do echo -n -e "\xe2\x95\xb$((($RANDOM&1)+1))"; done
Anyone dumb enough to pay for something that is abundantly free deserves whatever they get.
On another note I have an abundant supply of di-hydrogen monoxide I am looking to sell. It is extremely useful for many applications. Regularly priced at up to $4.00 / litre, I am willing to part with it for only $0.50 / litre. Msg me for details!
I'm surprised that more banks don't make you retrieve credit/debit cards at local branches. Lots of cameras to help verify who you are. I know that when I want to change my PIN, I have to go to a WAMU branch to do it, whereas I can remember doing it online just a few years ago.
GetOuttaMySpace - The Anti-Social Network
Actually, I would say that it is quite a bit different. A fool might be duped into believing the sales pitch of enlargement pills or that a Nigerian prince can't find anyone to accept money, but the point of phishing is to establish a false sense of security where the victim believes they're dealing with a secure, reputable business - usually one where they already have a solid relationship. I can see a lot of people falling for well-designed, sophisticated phishing attacks.
This space intentionally left blank.
That is if you trust this figure.... ... Gartner is not the most relaible source, and how did they come up with this estimate, when the victims mostly will not tell people they were scammed, and the banks will not release their losses ...
Puteulanus fenestra mortis
Gartner's wording shows a definite bias against those using alternative income techniques. Here's another way to read their summary:
"Gartner's latest survey into the realm of phishing shows increased income for 2007, with record revenue of $3.2 Billion (that's Billion, with a B) U.S. Dollars. Overall income per incident fell (to $886 from $1,244 made on average in 2006) but the numbers of individuals who subscribed rose quite sharply from 2.3 Million in 2006 to an impressive 3.6 Million. Though online portals Paypal and eBay remained the most useful brands, it appears phishing entrepreneurs are getting more creative utilizing fake electronic greetings cards, foreign businesses, and charitable organizations in their portfolio of profit generating techniques. Furthermore these budding corporate executives are increasingly taking interest in debit card and banking credentials rather than credit cards, because the alternative income technique protection mechanisms there are far weaker, according to a study done at The University of California at Berkeley."
</sarcasm>
-USR1
Hmmm now you have me thinking. I've had 2 banks where this happened to me. Actually, no, a bank and a credit union. The Bank gave me a HUGE hassle, I'd purchased a few things online in the months before and then over a 2 day period someone with my card number purchased over 800$ worth of things online. They never called me, I had to call my bank on it. They made me pay for a replacement card and ALMOST had me convinced that I had to buy some sort of insurance if I wanted to get reimbursed (scammy, eh?) Turns out the insurance isn't mandatory, it's just like a VIP club for those who apparently have this happen to them often.
The Credit Union? They called me, they stopped my card instantly, they sent me a new one (I just had to fax my signature.) They even opened a police report in L.A. where the perp lived (dumbass used the number to buy gas in a few different stations.)
He was never caught but let's just say the bank no longer has my business.