Phishing in the backyard

A nasty new strain of scam comes from trusted sources

The best phishing e-mail I've seen recently purported to come from none other than the head of the FBI. "Robert Mueller" was offering to ensure the safety of a money transfer from a confidential third party, if only the recipient would provide her or his bank information in an official-looking form.

Being the inquisitive sort, I was fascinated that the director of the FBI would use a foreign e-mail address, that the form didn't appear to have been prepared by a native speaker, and that the FBI would provide "advance fee" funds transfer services. Nonetheless, some recipients of the e-mail have likely taken the bait, and find their self-assurance and bank balances thus reduced.

Well-executed confidence jobs are ones where the victim not only becomes convinced of the trustworthiness of the perpetrator, but acts as an advocate and defender of the process by which he or she is relieved of assets. In most cases, somewhat skeptical people can spot a phishing attempt because the request comes from an unprompted and dubious source. But what happens when the request appears to come from an authoritative, familiar source, and double-checking the address shows it originated from within one's own organization?

Con jobs on the job

This is not a hypothetical problem. Recent incidents, some made public and others discussed only in professional circles, indicate that an increasing number of successful intrusions into large organizations haven't aimed to steal the organization's data or resources, but to victimize the employees as individuals.

Instead of an outlandish request to send personal information and a few thousand dollars to facilitate the payout of umpteen millions from a long-lost royal relative in a defunct African republic, or a plea from the President to help funnel money from Iraq, the new phishing e-mails are frighteningly plausible.

For example, an employee might receive an e-mail claiming their direct deposit information had been lost in a system upgrade, and to please e-mail their account numbers and a scanned bank deposit slip to an address in the human resources department. There's little in a message like that to tip off potential victims, even if the phishing attempt is more aggressive -- say, a request to donate to a corporate-sponsored charity by providing credit card data, including a CVV2 number.

Even technically and financially astute people might send sensitive information via e-mail within an organization, assuming the data would never touch public networks such as the Internet. This assumption is even built into the Payment Card Industry Data Security Standard ( PCI-DSS version 1.1), which only requires "encrypt[ed] transmission of cardholder data across open, public networks."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jon Espenschied

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?