Phishing

OK, it’s been a month, so it’s time to talk about it again, phishing, which are emails that look like they came from your bank, or some such, but really didn’t. According to a recent article on BBC online, phishing is on the rise, which makes sense. The more people who respond, the more people who will try it. The reason I thought about it was, I got an email the other day. It seemed to be from Citi Bank, which I don’t have an account at, which of course always helps in spotting Phishing scams. Here it is, which certain things changed to protect the guilty: I have left the words spelled as they were in the email.

From: usersbilling@citibank.com
Subject: Attention all Citibank users!

Dear Citibank user,

Due to database operations some online banking accounts can be lost.
We are insiting to our clients to check their account if they are active or if their current balance is right.
Please follow this link and sign on to you online banking account:

https://someone other than.citibank.com/cgi-bin/citifi/scripts/login2/cbol_login.jsp

Thank you for using Citibank!

Do not relpy to this email.

The thing is, that even when I clicked on the link, which I could see was not from Citi Bank, I could see that at the top of the page, the URL wasn’t Citi Banks. It was clever though.

Here is the evil CitiBank site:

evil_citi.jpg

Notice that they ask you for everything. While the good CitiBank does not.

good_citi.jpg

Also, on the good CitiBank page, there is a link telling to watch out for these sort of scams, which of course the bad site does not. In fact, if someone is thinking about it, even if they don’t notice that the url is wrong, they might notice that none of the other links work. Hmm. that would make me suspicious.

According to a recent article on the BBC News web page, the phishers are getting even more sophisticated than that. They are coming up with a way to spoof the web address in the browser window, so you can’t tell that you aren’t on the site.

Phishing is so big, that according to Internetnews, Earthlink released on April 19th, something called “ScamBlocker”, that will be loaded onto your browser (yours not mine, as I expect it won’t work with Macs), that will redirect you away from know phishing sites, to a site run by Earthlink warning you about phishing. They are the first ISP to do this. I doubt they will be the last.

According to a recent article in Newsweek, the banks, and other online service aren’t so worried about losing money and having to reimburse their clients, but that on-line users will lose faith in the system, and not go to the websites anymore.


Leave a Reply