Feeds

Phishing losses overestimated - survey

Small fry

  • alert
  • submit to reddit

Top 5 reasons to deploy VMware with Tegile

Fraud losses from email phishing attacks will hit $137m globally in 2004, according to a study from research and consulting firm TowerGroup. The figure is much lower than previous estimates. For example, a September survey commissioned by TRUSTean, an online privacy non-profit organization and NACHA, an electronic payments association, put US phishing losses to date at $500m.

TowerGroup reckons previous studies have overstated financial losses while underplaying the potential impact of phishing on lost consumer confidence. Phishing attacks are successful in fooling only a very small fraction of the online population and are, to many consumers, a nuisance like spam. TowerGroup reckons other analysts have overestimated response rates.

Beth Robertson, senior analyst in the global payments research service at TowerGroup and co-author of the research, said "Phishing attacks can allow criminals to fraudulently obtain consumer data, but they do not as commonly result in an actual fraud event in which accounts are accessed or funds are stolen."

Scam emails that form the basis of phishing attacks often pose as 'security check' emails from well-known businesses. These messages attempt to trick users into handing over their account details and passwords to bogus sites. The collected details are used for credit card fraud and identity theft. First seen more than a year ago, phishing emails are becoming increasingly sophisticated, directing users to bogus websites which accurately reproduce the look and feel of legitimate sites.

Like most observers TowerGroup agrees that phishing is on the rise but it reckons other surveys underreport the actual level and mix of phishing attacks. It estimates the number of phishing attacks will top 31,000 globally in 2004, reaching 86,000 next year as fraudsters begin to target customers of smaller financial institutions and a wider range of online merchants.

Phishing attacks are becoming more sophisticated as "organized crime rings have taken over much of its development" TowerGroup notes. "Not only has the quality of fake emails improved, but more effective targeting is increasing the efficiency of phishing attacks. Phishers are also integrating their scams with malicious software (or "malware") downloads, as well as complex new variants better classified as 'malware attacks' than as phishing - making the threat from these attacks more dangerous and more difficult to detect and prevent," it said.

The cost of managing phishing losses will be "far greater" than the cost of direct fraud. George Tubin, senior analyst at TowerGroup and co-author of the research, said: "One of the greatest liabilities is the potential loss of customer confidence in the Internet as a channel for provisioning financial services, not to mention loss of trust in financial institutions themselves. This is a critical issue, given the rising importance of the online channel in the retail financial services delivery mix."

The TowerGroup research report titled, A Phish Tale? Moving From Hype to Reality, catalogues the increasing sophistication of phishing and related internet scams. A companion report, No Phishing Zone: Vendor and Industry Initiatives to Curb E-Mail Fraud, looks at how the financial services industry is fighting the problem. ®

Related stories

Phishers tapping botnets to automate attacks
Fraudsters recruit phishing middlemen
Trojan targets UK online bank accounts
Consumers hit by net security jitters
Four charged in landmark UK phishing case
UK banks launch anti-phishing website
US phishing losses hit $500m

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.