March 01, 2004 — CSO — "Recently our customers have reported receiving fraudulent e-mails that appear to be from Bank One," begins an e-mail that appears to be from Bank One. "Please log in and learn more about what's happening and how to protect yourself."
It sounds convincing enough. But recipients who followed the link are taken not to Bank One's website but to a bogus one set up to gather user names and passwords. It's the latest kind of Internet scam—one that's known as "phishing," explains Dave Jevans, chairman of the newly formed Anti-Phishing Working Group and a marketing senior vice president for Tumbleweed Communications, noting that the hacking community has been using "ph" instead of "f" since the days of "phone phreaking" in the 1970s. "They're out there casting a wide net and pulling in a smaller number of fish."
While some scams are easily spotted by misspelled words and bizarre claims, others are becoming increasingly sophisticated, copying graphics and text from legitimate e-mails and websites.
Even the bogus URLs are getting harder to spot. Phishers trick users with links to websites that were similar to legitimate ones
"The majority of phishing e-mails are looking to steal your information or online user ID, as opposed to trying to assume your identity," says Howard Schmidt, former vice chairman of the president's Critical Infrastructure Protection Board and eBay CISO. "But the results are not much different. You still have to go back and clear your credit record and show that wasn't you."
Other stories by Sarah D. Scalet
Data Center Directions Virtual Conference
Attend this free, 100% online event exploring tools and techniques for making your data center deliver for today and tomorrow.
The Surest Path to Effective and Efficient Compliance
In this webcast, we explore why and how with best practices, practical tips and solutions that work to ease your compliance challenge.




