2214 Corporate ID Theft

The Fraud Advisory fapPanel the fraud Have you been scammed? advisory Identifying Internet panel and Email Scams HAVE YOU BEEN SCAMMED? Identifying Internet and Email Scams 1. Introduction The enormous growth of the Internet has resulted in a rising number of website domain name registrations by businesses and organisations hoping to profit by expanding into e-commerce. This rise has been coupled with increasing levels of Internet fraud and misuse. One particular problem for businesses is that of copycat and ambiguous domain names and websites. Web pages may be copied in order to dupe customers into dealing with less reputable businesses or to direct/divert consumers to illicit sites that might otherwise have been overlooked or avoided. Alternatively, fake websites may be created in order to defraud consumers or other businesses. The practice of creating a fake website in order to dupe consumers is known as “spoofing”. There are a variety of different scams involving spoofing. This paper is designed to give businesses and individuals a brief guide to identifying Internet and email scams, including: • Phishing • Cybersquatting and other forms of spoof websites • Hoax emails 2. Phishing 2.1 What is “phishing”? Phishing is a relatively new term used to describe attempts to trick people into disclosing personal, financial or security information to replica websites operated by fraudsters. This is an example of a “social engineering” attack where a trusted organisation’s identity is used to add credibility to the scam in order to persuade people to carry out actions which they would not have done, had they known the true identity of the perpetrators. In this way, the attack is directed at customers of a particular organisation, rather than at the organisation itself. Numerous companies operating on the Internet have been “targeted” by phishing attacks, including banks, Internet retailers, auction websites and government departments. “Phishing” is a play on the word “fishing” (ie. fishing for information) and originates from 1996 when people set up replica AOL websites to gather screen names and passwords to get free online access. Such access details were known as “phish” by the community. Phishing typically relies on mass distribution of spam emails at random, with the aim of reaching as many live email addresses as possible belonging 1 to customers of the organisation being targeted. Email addresses are obtained by a variety of means including commercially available address lists, harvesting them from websites and news groups and semi-random generation. Phishing scams normally involve the fraudster sending bulk email messages purportedly from a bank or other well-known company operating on the Internet. The email will typically use an excuse to request that recipients confirm account and security information and redirect the recipient to a bogus but realistic website via a link contained in the email message. Excuses can include a security breach or some other urgent event at the company, although some messages have themselves purported to be scam warnings or marketing offers, so customers have to be wary of any unsolicited email requesting that they click on a link to go to a website. Security details entered into the bogus website can then be used by the fraudster to access the victim’s account. Often, the fraudster will transfer money to accounts under their control in a laundering process, so that they may benefit from the proceeds of their fraud. In some cases the internet browser programs allow the true source of the bogus website to be disguised from the user and the victim is therefore unaware of the deception until sometime later when funds have been transferred out of the account. For example a link which appears to read www.abcbank.co.uk/securitycheck may redirect the victim to a completely different part of the Internet that has nothing to do with ABC Bank. A search on Ebay will reveal that lists of millions of email addresses are for sale for a few pounds. At the time of writing, several sellers on Ebay are offering “100,000,000 Email addresses for all your marketing needs” for £9.99. With very large email lists readily available, the fraudster is able to cast the net very widely and very cheaply and it only needs a small percentage of people to be taken in by the scam to make it very profitable for the fraudster. Phishing is unique in that it combines the economies of scale of spam and the shortcomings of some Internet browsers to work a simple but serious deception. Phishing can also be very difficult to prosecute as the fraudster may be located in any country and the local legal system may not be sufficiently developed to enable the crime to be prosecuted. The majority of phishing emails are sent through open email proxies, or compromised home computers controlled by spammers, making it extremely difficult to trace the true originators. As a result phishing can be very appealing to a potential fraudster. Many Internet Service Providers (“ISPs”) block such spam emails, however there are certain ISPs in lesser-developed countries which choose to turn a blind eye to the process. In certain cases the fraudster and ISP may have common ownership as a part of a larger criminal enterprise. The quality of phishing emails is variable. Some are very convincing and are almost indistinguishable from a bona fide email from the company being impersonated. Others suffer from poor English grammar or spelling which may indicate that the 2 scam is being operated from outside the UK. However, as the fraudsters become more experienced at their craft, this leads to increasingly convincing and sophisticated phishing schemes. Many phishing scams are thought to be operated by organised criminals located in Eastern Europe. The proceeds of phishing may be used to fund further crimes such as people and drug trafficking, prostitution and perhaps terrorism. In the event that the phishers have managed to obtain Internet banking security details, they need a method of obtaining the money, as it is not possible to transfer the money directly overseas. To help with this process, fraudsters recruit people to receive funds into their own bank account and send them on via a wire transfer service in return for a small commission (normally 7–10%). These “money transfer agents” or “mules” are recruited via fake job offers sent by spam email, adverts on genuine recruitment websites, ICQ (instant messaging), as well as adverts appearing in broadsheet newspapers. Positions on offer include sales representatives, finance managers, mail forwarders and numerous other “work from home” opportunities. These mules are also used to forward goods purchased from e-commerce websites using stolen credit cards as well as funds obtained through bonus auctions. As the money received in commission payments is the proceed of fraud, it will be confiscated by the bank. Individuals who provide personal information in support of a fake job offer put themselves at risk of identity fraud, as well as having their accounts closed by the bank and becoming embroiled in a police investigation. 2.2 What is Being Done About It? The major banks, credit card companies, Internet companies and law enforcement agencies are acutely aware of the problem and are working with ISPs to combat the problem. As soon as an ISP becomes aware of a phishing scam it will notify the company concerned so that it can take appropriate action. This may involve sending an email warning to all its customers. Action will also be taken to disable the bogus website. However, this may take some time if the website is hosted in a lesser well-developed country. The UK has a dedicated law enforcement agency, the National High Tech Crime Unit (“NHTCU”) tasked with policing serious and organised computer crime and other uses of the internet for criminal purposes. 2.3 What Can You Do? i. Individuals There are a number of steps that individuals can take to minimise the risk of becoming a victim of a phishing scam: (a) NEVER divulge your security information to anyone requesting it by email or phone. 3 If you do receive an email which you suspect to be a phishing scam, do not reply to it or click on the link to view the website. If you are concerned about the message, inform the company by calling a publicly listed telephone number, or by forwarding the email (preferably as an attachment including header information) to the dedicated address given on their website. Remember, the safest way to access the company’s website (where there may be a warming about this particular scam) is to type the address yourself into your web-browser rather than clicking on the link. (b) Use DIFFERENT passwords for different accounts. Be very protective over all your passwords and use different passwords for different banking or credit accounts and email services. Once a fraudster has your password he or she may then try to hack into your email account using that password to find out more information about you. Your email account contains much information about you and the fraudster could use this information to impersonate you. For example, the fraudster may apply for credit online or use your identity to open new accounts in your name. If your “Inbox” or “Sent Items” contains emails to or from banks then expect the fraudster to try to gain access to these accounts. This “snowball” effect can be the result of divulging one password to the fraudster. (c) Use IMAGINATIVE passwords containing numbers and other characters wherever possible. One recent survey1 has found that as a result of having too many passwords to remember, many internet users tend to use one easy to remember password such as the name of a spouse, children, favourite football team and/or pet for all their accounts.

Load more