From the bad guy’s perspective traditional phishing has costs and benefits. On the cost side there’s a few hundred dollars to get a million name target list, a few dollars to handle the emailing, either some real effort or few thousand dollars to get the website and related scam components set-up, and some risk of prosecution.

The benefits have been gradually decreasing as phishing’s succcesses have made people more aware of internet banking risks: where five years ago a few thousand people might respond to a million name emailing, phishers now get a few hundred -and because the internet sophistication displayed by those who fall for these scams is corelated with income, there’s usually less to steal too.

Worse, the liklihood of prosecution has been going up - or, more precisely, law enforcement has steadily reduced the harvest window: the interval from sendout to having to shut down the servers and scuttle for cover.

So what’s a phisher to do?

My wife just received a letter from our friendly national bank card carrier that included a new credit card, the information that one of our cards had been compromised, and the 800 number to call to activate the replacement.

Activation required knowledge of the old card number, it’s expiry date, the recognition code, and the two digit check code - everything a phisher needs to strip the account.

The overall process wouldn’t be hard to phish. Since you can buy card holder name lists that have pretty good accuracy for a few thousand bucks, printing up 100,000 fake cards, sending them out, and manning an 800 line that redirects somewhere the cops don’t want to co-operate with American or international police agencies - like Cuba, Syria, or Venuzuela - might cost the bad guy a grand total of maybe four hundred thousand up front and about a quarter of that for the next 100,000.

Read full article on ZDNET

By Paul Murphy
May 1st, 2008

---

Last update : 18-05-2008 04:19