What would you do if you received an email that was apparently from HM Revenue and Customs saying you were owed a tax refund and mentioned a specific amount? For several people who read such an email this summer, following a link and entering their bank card details seemed the right thing to do. But rather than getting a refund, they ended up being telephoned by The Guardian instead.
The names came via Prevx, an internet security company, which was offered and bought a set of details online from an unwary criminal based in Romania. We asked the victims: why were you taken in? The dozen we spoke to said they were expecting a tax refund, so gave away their details (name, date of birth, address, card number, expiry date, and three-digit security code) without much thought. Their reaction to our calls: suspicion, astonishment, and, lastly, embarrassment.
Phishing isn't new. Criminals, mostly in Eastern Europe, send out convincing emails linking to bogus websites which closely match genuine organisations. Any personal details obtained are sold to other criminals who then defraud the victims' bank accounts or credit cards.
But the example shows that opportunism - and luck - lies behind successful phishing attacks. The Guardian established that the personal data in these cases were linked to this HMRC phishing email. If people are expecting a new PIN from their bank, or new passcode, they will be vulnerable to phishing like this. Lots are: phishers sell thousands of stolen bank and credit card details every month.
Jacques Erasmus of Prevx says the deals are done in secret forums and chatrooms; the going rate is 10 euros per debit or credit card details. An online bank account login "costs"10% of the account balance.
We passed the victims' details to Apacs, the UK payments association, which quickly alerted several banks to prevent any losses. The first half of 2008 saw more than 20,000 reported phishing incidents - 180% higher than the same period last year. What's being done to curb this? Financial institutions simply refund consumer losses (in 2007, total online banking fraud fell to £22.6 million) while protection mainly relies on education. The Apacs advice website - banksafeonline.org.uk - includes examples of phishing emails.
The Serious Organised Crime Agency has a "dedicated e-crime unit", and said it is working on phishing attacks, but refused to elaborate. Does it buy stolen UK card details to trace phishers through money transfers? What technical expertise has it got available? We don't know. Meanwhile, the phishers will reel in even more victims.
No responsibility can be taken for the content of external Internet sites.
Return to internet news headlines
View Internet News Archive