500 million dollars lost in Internet 'phishing' scams in US
496971
US consumers and businesses have lost an estimated 500 million dollars to a relatively new Internet scam known as &quot;phishing,&quot; according to a survey released this week.
288407
Recent "phishing" episodes are still often overlooked by tech-savvy users, but a lesson in history shows how entire nations have been fooled.
200219
Internet companies and law-enforcement agencies said on Wednesday they will work together to track down online scam artists who pose as banks and other legitimate businesses, a practice known as "phishing."
80272
Tool that identifies sites pretending to be connected to banks, eBay and more could help leave "phishing" scammers dead in the water.
513359
The operators of movieland.com, moviepass.tv and popcorn.net agree to fork over more than $500,000 in consumer payback after accusations that the sites deceived users.
624233
Scams that use spoofed Web sites of banks and other trusted bodies pulled in a majority of U.S. surfers, a survey has found.
736046
BOSTON - The number of phishing Web sites associated with online identity theft scams grew by 33 percent in November, after dropping off in September and early October, according to data compiled by the Anti-Phishing Working Group (APWG) and shared with IDG News Service.
448789
9 out of 10 crooks use ready-made code Phishing kits are helping to dumb down the process of creating fraudulent websites. Back in the day, setting up a bogus facsimile of a banking site required a modicum of programming skills. No more.â¦
342427
Phishing scams increased by more than 100% in October causing banks, financial services firms and popular consumer websites until grief.
320828
Would-be borrowers in the U.S. and Canada are being bilked out of thousands of dollars by unscrupulous online lenders.
236787
With consumers finally getting wise to phishing attacks, scammers are hitting the phones.The U.S. Federal Bureau of Investigation&#39;s Internet Crime Complaint Center (IC3) warned Thursday that so-called &quot;vishing&quot; attacks are on the rise. These are scams where criminals send an e-mail or text message to a victim, saying there has been a security problem and the victim needs to call his or her bank to reactivate a credit or debit card.&quot;Upon calling the telephone number, the recipient is greeted with &#39;Welcome to the bank of ...&#39; and then [is] requested to enter their card number in order to resolve a pending security issue,&quot; the IC3 said in its alert.In the past few years, inexpensive VoIP&#160;technology and open-source call-center software has made it inexpensive for scammers to set up phony call centers, paving the way for these new types of scams. Security experts say that vishing can be more effective than traditional phishing techniques -- which direct victims to fake Web sites -- because the voice-based attacks have not been as widely publicized.A new vishing scam involves sending text messages to cell phones, instructing victims to contact the fake online bank to renew their accounts, the IC3 said.Those who are unsure whether they have been targeted by this scam should look up the bank&#39;s phone number and call the bank directly, the IC3 advises.Operated in partnership with the FBI and the National White Collar Crime Center, the IC3 is a clearing house for Internet crime complaints.
749565
Phishing is a growing form of online fraud that blends old-fashioned confidence scams with innovations in technological trickery. In the second part of our two-part series, washingtonpost.com explores how banks, Internet service providers and other online businesses are trying to make e-commerce safe for their customers.-washingtonpost.com
724562
Until just a few months ago, Gary Warner did not have the kind of day job you&#39;d expect from an antiphishing crusader. He didn&#39;t work for a security vendor or a bank, or any kind of company you&#39;d expect to care about phishing.Warner&#39;s career as a cyber-sleuth began on Halloween 2000. That&#39;s when his company&#39;s Web site was defaced by a hacker named Pimpshiz as part of a pro-Napster Internet graffiti campaign.&quot;My boss came to me and said, &#39;Find out who did this and put them in jail,&#39;&quot; said Warner, who was at the time an IT staffer with Energen, a Birmingham, Alabama oil and gas company.It was an eye-opening experience. &quot;I called the police and they were like, &#39;What do you want us to do?&#39;&quot; he said.Months later, when Pimpshiz struck servers at NASA, Warner reached out, calling staff there and saying &quot;Hey, we know who this guy is. Here&#39;s his name and address.&quot;Since then, Warner has quietly become one of the most-respected authorities on phishing in the U.S. -- the kind of guy that federal agents and banking IT staff call when they want to know how to catch the bad guys and shut down their credit-card-stealing Web sites.With Warner&#39;s help, authorities eventually arrested Pimpshiz, whose real name is Robert Lyttle,&#160;in connection with the hacks.Fishing for PhishersWarner said that the Pimpshiz case was formative, underlining how hard it is for law enforcement to catch the bad guys on the Internet.&quot;The experience showed me that it&#39;s not that they don&#39;t care,&quot; Warner said.&#160;&quot;Their hands are tied by the legal process.&quot;Soon, Warner found himself spending dozens of hours each week compiling data on spammers and phishing attacks. &quot;I would sit for a couple of hours every morning and find all the new phishing sites that I could,&quot; he said.He&#39;d take screenshots of the sites, e-mail the Webmasters who were hosting them and ask them for Web logs, and eventually he started making connections -- he&#39;d connect one phishing group with several different attacks -- and learn who he needed to call to get Web sites removed, no matter where in the world they were hosted.He&#39;d get calls from IT staff at small credit unions asking for help taking down fraudulent sites, every day, all day long. It was cutting in on his work. Late last year, he decided to make a change. &quot;I went to my boss and told him that I&#39;m going to look for a way to do this full time.&quot;Helping the Feds Crack Down on Online FraudIn July, with recommendations from FBI and Secret Service agents,&#160;Warner took a job as Director of Research in Computer Forensics with the University of Alabama at Birmingham (UAB).He also began working with law enforcement, not only educating FBI and Secret Service agents on how crimes were committed, but also helping to track down the criminals and helping with take-downs.&quot;He&#39;s an outstanding resource for the FBI,&quot; said Dale Miskell,&#160;supervisory special agent with the FBI&#39;s Birmingham Cyber Crime unit, who has worked with Warner since 2005.Miskell said Warner has helped the FBI with investigations and taught staff about his antiphishing techniques.&quot;He could be a multimillionare by his skillsets... he&#39;s a very gifted speaker, he can talk to the techies, and then he can turn around and talk to the non-techies and everyone will understand.&quot;Warner is now focusing on fighting cyber-crime full-time and on training a new generation of network forensics investigators. &quot;You wouldn&#39;t believe the looks on their eyes the first time they got an e-mail back from a Webmaster saying, &#39;Thanks for letting me know. I just shut that down.&#39;&quot;When he spoke with IDG News, it was five days after final exams at the University of Alabama at Birmingham and though it would have no effect on their marks, four students were still coming into the labs to help shut down phishers.&quot;That idea that as a private citizen, you can help, that&#39;s the kind of thing we&#39;re trying to inspire,&quot; he said.The Future of Phish-bustingAt the University, Warner is building up a 256-node supercomputer which could eventually become the largest collection of spam email on the planet, processing as many as 100 million email messages per day and providing researchers and law enforcement with valuable analysis data.For Warner, the work isn&#39;t so much a job, as it is his moral responsibility as a computer scientist. &quot;One of the things that really bothered me from the very beginning was people who were using my field to attack other people,&quot; he said. &quot;The way I see it, this is our Internet. I&#39;m going to stand at the end of my driveway and protect what&#39;s mine.&quot;He says that his anti-phishing work hardly feels like work at all. &quot;This is what I like to do,&quot; he said. &quot;It&#39;s cheaper than golf, and you can do it when the weather&#39;s bad.&quot;What You Can Do to Protect Yourself&quot;The best people that help law enforcement have no motive other than to catch the bad guy,&quot; said one law enforcement official who declined to be identified because he hadn&#39;t been authorized to speak with the press.But even if you&#39;re not a cyber sleuth, if you get hit by a computer criminal there are some things you can do to help police catch the criminal. What you should do depends a little bit on the crime. If you&#39;re the victim of identity theft, it&#39;s worth filing a report with state and local police so that you have a record of the crime.That comes in handy later, in case you need to prove that it was the thief, and not you, that incurred any subsequent charges. Another good place to stop is the Federal Trade Commission (FTC) site, which has a variety of tools to help identity theft victims get organized and set their credit back on track. And if things get really bad, the Social Security Administration can help you, too. This site has instructions on how to report social security fraud and get a new social security number.You can file a report with the FTC, but if you want your data to be used to catch the bad guys, the Internet Crime Complaint Center (IC3) is a better bet. Run in part by the FBI, the IC3 data is used regularly by law enforcement to link together large schemes. The more factual data you can report about your crime, the more useful it will be to police. Sometimes a single fax number or eBay ID can help crack open an entire case.The FBI is most interested in crimes that involve malicious software, phishing, and child pornography. Spam and auction fraud get a lower priority and, worse, if you&#39;re the victim of an auction fraud, the odds of you ever getting your money back are very low.Still, if you&#39;re rigorous about documenting the crime, and you fill out that IC3 complaint, you just may be helping to bring down your criminal -- some day.
181199
Interesting tidbit that was Slashdotted earlier - Netcraft has released an anti-phishing toolbar that leverages the enormous database of web sites the organization manages.
687414
Phishing is one of the fastest-growing forms of personal fraud in the world. While consumers are the most obvious victims, the damage spreads far wider--hurting companies&#39; finances and reputations and potentially
586072
The Anti-Phishing Working Group, in its most recent report, said that online scam artists are turning to new tactics to try to trick Web surfers into divulging financial information.
30755
The latest information on phishing indicates that fraudsters are increasingly using malicious software to direct users to their deceptive sites.The Anti-Phishing Working Group (APWG) said in a new report Thursday that it saw a sharp rise in November in malware that directs users to DNS (Domain Name System) servers controlled by&#160;phishers.DNS servers play a crucial role in locating Web sites. The servers translate a domain name into an IP (Internet protocol) address, enabling a Web site to be located and accessed through a browser.Often, the phishers will set up their own DNS server that works fine most of the time but can redirect to their own malicious site.Tainting a person&#39;s DNS settings is particularly dangerous since the user probably won&#39;t notice the redirection, the APWG said.&quot;The fraudulent server replies with &#39;good&#39; answers for most domains, however, when they want to direct you to a fraudulent one, they simply modify their name server responses,&quot; the report said.Phishers are also employing malware that modifies an internal PC file called the hosts, which is used to match domain names of Web sites with IP addresses.When a person visits a Web site, the browser checks the hosts to see if it has an IP address for a particular domain name. If the hosts file is corrupted or hijacked, the browser can be directed to fetch a different Web page than the one the user intended to go to.Both attacks -- also known as pharming -- are dangerous, since a user may be typing in the correct URL (uniform resource locator) but be directed to the phishing site.The APWG reported that the overall number of unique phishing sites declined in November, but 178 different brands were targeted, a record number. By comparison, 120 brands were used in phishing attacks in October. The highest previous total was in April 2007, when 174 brands were targeted.More Middle Eastern and European financial services companies were spoofed in phishing schemes, APWG said. The financial services industry is the most targeted for fraud, comprising 93.8 percent of all phishing attacks.&#160;