Phishers Pocket $2.8 Billion From Unsuspecting Consumers - InformationWeek
02:18 PM

Phishers Pocket $2.8 Billion From Unsuspecting Consumers

Criminals running phishing scams are raking in more money than ever, with the average loss jumping fivefold in the last year and the percentage of money recovered plummeting, according to a survey published Thursday by research firm Gartner.

Criminals running phishing scams are raking in more money than ever, with the average loss jumping fivefold in the last year and the percentage of money recovered plummeting, according to a survey published Thursday by research firm Gartner.

"Phishing e-mails are getting through, and when they do steal, phishers are getting five times the amount they did in 2005," said Gartner analyst Avivah Litan. "They're getting better, much better, at their schemes." Litan pegged the total loss to phishing in the 12 months ending Aug. 30 at a whopping $2.8 billion.

Although some analysts have pegged phishing attacks as leveling off, Litan scoffed at the notion. "It was presumptuous of us to think that phishing would be solved, much like spam has been, and would be only so much 'noise' on the Internet," Litan said.

According to Litan's research, almost twice as many Americans admitted that they'd received a phishing e-mail in 2006 as did in 2004. The survey's tallies correlate to 109 million consumers seeing an attack in 2006, compared to 79 million in 2005 and just 57 million in 2004. More consumers also acknowledged that they'd gone as far as to actually click on a link in a phishing e-mail; in 2006, the percentage of those who said they'd received a phish and clicked on a link was nearly 25 percent. In 2005, the number was only 15 percent.

Even more distressing, said Litan, was that while the number of people who said they'd lost money to online fraud went down by 24 percent, the average loss skyrocketed from $257 in 2005 to $1,244 in 2006. Worse, the percentage of the lost money that was recovered or refunded to the consumer dropped precipitously.

"The recovery rate has gone from 80 percent of the loss to just 64 percent," said Litan. That translated into a tenfold leap in the out-of-pocket hit on the average phishing victim. In 2005, for example, after recovered funds were factored, victims were out an average of $51; in 2006, that jumped to $572.

Trends like that are alarming, said Litan, and point out the rapid shift in phishers strategies. "The amounts that big banks are losing is going down," said Litan. Security protections implemented by large financial institutions -- such as Citibank and Bank of America -- have squeezed losses. "They're paying less money out. But the phishers are just going down the totem pole. They're using sweepstakes offers, lottery offers, fake auctions, and attacking PayPal."

Litan called the traditional phishing attack, where criminals try to dupe consumers into divulging their bank or credit card account username and password, "old hat."

Instead, attacks have moved into what Litan called unconventional territory, attacks using techniques that don't directly involve a bank or credit card account, but that leave the victim little or no recourse for recovering losses. One example: Western Union money transfers to "sellers" of fake auctioned items. "In most cases, payments made with non-bank money transfer systems are final and consumers can't reverse them once the money is moved," said Litan.

Fighting phishing is tough for the consumer, Litan agreed. The criminals seem to always be a step, or more, ahead. Anti-phishing features in the newest browsers, such as Microsoft's Internet Explorer, for example, are obsolete by the time they're introduced.

"A year ago, the average lifespan of a phishing site was a week," said Litan. "Now it's close to an hour. Most anti-phishing toolbars are largely based on blacklisting [known phishing sites]. You can't blacklist an IP address that changes every hour. By the time that IE 7 came out, it was too late to be much help."

While some technologies look promising -- white lists, or lists of trusted sites, is promising, said Litan, as is heuristic-based fraud detection if it's built into the browser -- the immediate future looks grim.

"When you lose to a phisher, you'll lose bigger and you won't get your money back," said Litan. "Less conventional attacks mean that losses will go up in 2007 even as the number of successful attacks go down. In the end, more money will be lost next year."

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
How Enterprises Are Attacking the IT Security Enterprise
How Enterprises Are Attacking the IT Security Enterprise
To learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Register for InformationWeek Newsletters
White Papers
Current Issue
Digital Transformation Myths & Truths
Transformation is on every IT organization's to-do list, but effectively transforming IT means a major shift in technology as well as business models and culture. In this IT Trend Report, we examine some of the misconceptions of digital transformation and look at steps you can take to succeed technically and culturally.
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll