Feeds

One in 200 success rate keeps phishing economy ticking over

Nibbles add up to big haul

Protecting against web application threats using SSL

Phishers only need to land a minute percentage of victims to make scams worthwhile.

Stats culled from Trusteer's anti-phishing browser plug-in, which is offered by banks to their clients as a transaction security add-on, revealed that 0.47 per cent of a bank’s customers fall victim to phishing attacks each year. The figure comes from the number of users who visited and attempted to enter data onto a known phishing site but escaped because they were using Trusteer's Rapport browser security plug-in.

Half (45 per cent) of bank customers who are redirected towards a phishing site attempted to hand over their login credentials.

The overall response rate to phishing scams translates to between $2.4m-$9.4m in annual fraud losses (per one million online banking clients), according to Trusteer.

Trusteer's report (PDF) is worth considering because it looks at how many would-be marks respond to phishing emails (ie live attack data). Most surveys only look at how many phishing attacks are launched and what brands are targeted, without considering how successful these attacks actually might be.

The security software firm has come to prominence this year after signing up many banks, including NatWest and Alliance & Leicester in the UK, as customers of its transaction security software. Trusteer obviously has a vested interest in talking up the financial losses and danger posed by phishing but that doesn't mean it's necessarily wrong.

Harvesting online bank login credentials before cashing out compromised accounts is a major activity in the underground economy, which is growing more sophisticated and mature. The market has grown to the point where hackers have developed tools to harvest data from phishers, a sort of virtual stick-up.

The cyber equivalent of The Wire's Omar Little have developed an auto-whaling tool designed to harvest logins stored on phishing sites. Such attacks are possible because crooks themselves are making website security errors, as a blog post by FaceTime security researcher Chris Boyd explains. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.