Phishing in the backyard

A nasty new strain of scam comes from trusted sources

The best phishing e-mail I've seen recently purported to come from none other than the head of the FBI. "Robert Mueller" was offering to ensure the safety of a money transfer from a confidential third party, if only the recipient would provide her or his bank information in an official-looking form.

Being the inquisitive sort, I was fascinated that the director of the FBI would use a foreign e-mail address, that the form didn't appear to have been prepared by a native speaker, and that the FBI would provide "advance fee" funds transfer services. Nonetheless, some recipients of the e-mail have likely taken the bait, and find their self-assurance and bank balances thus reduced.

Well-executed confidence jobs are ones where the victim not only becomes convinced of the trustworthiness of the perpetrator, but acts as an advocate and defender of the process by which he or she is relieved of assets. In most cases, somewhat skeptical people can spot a phishing attempt because the request comes from an unprompted and dubious source. But what happens when the request appears to come from an authoritative, familiar source, and double-checking the address shows it originated from within one's own organization?

Con jobs on the job

This is not a hypothetical problem. Recent incidents, some made public and others discussed only in professional circles, indicate that an increasing number of successful intrusions into large organizations haven't aimed to steal the organization's data or resources, but to victimize the employees as individuals.

Instead of an outlandish request to send personal information and a few thousand dollars to facilitate the payout of umpteen millions from a long-lost royal relative in a defunct African republic, or a plea from the President to help funnel money from Iraq, the new phishing e-mails are frighteningly plausible.

For example, an employee might receive an e-mail claiming their direct deposit information had been lost in a system upgrade, and to please e-mail their account numbers and a scanned bank deposit slip to an address in the human resources department. There's little in a message like that to tip off potential victims, even if the phishing attempt is more aggressive -- say, a request to donate to a corporate-sponsored charity by providing credit card data, including a CVV2 number.

Even technically and financially astute people might send sensitive information via e-mail within an organization, assuming the data would never touch public networks such as the Internet. This assumption is even built into the Payment Card Industry Data Security Standard ( PCI-DSS version 1.1), which only requires "encrypt[ed] transmission of cardholder data across open, public networks."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jon Espenschied

Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?