Phishing in the backyard

A nasty new strain of scam comes from trusted sources

The best phishing e-mail I've seen recently purported to come from none other than the head of the FBI. "Robert Mueller" was offering to ensure the safety of a money transfer from a confidential third party, if only the recipient would provide her or his bank information in an official-looking form.

Being the inquisitive sort, I was fascinated that the director of the FBI would use a foreign e-mail address, that the form didn't appear to have been prepared by a native speaker, and that the FBI would provide "advance fee" funds transfer services. Nonetheless, some recipients of the e-mail have likely taken the bait, and find their self-assurance and bank balances thus reduced.

Well-executed confidence jobs are ones where the victim not only becomes convinced of the trustworthiness of the perpetrator, but acts as an advocate and defender of the process by which he or she is relieved of assets. In most cases, somewhat skeptical people can spot a phishing attempt because the request comes from an unprompted and dubious source. But what happens when the request appears to come from an authoritative, familiar source, and double-checking the address shows it originated from within one's own organization?

Con jobs on the job

This is not a hypothetical problem. Recent incidents, some made public and others discussed only in professional circles, indicate that an increasing number of successful intrusions into large organizations haven't aimed to steal the organization's data or resources, but to victimize the employees as individuals.

Instead of an outlandish request to send personal information and a few thousand dollars to facilitate the payout of umpteen millions from a long-lost royal relative in a defunct African republic, or a plea from the President to help funnel money from Iraq, the new phishing e-mails are frighteningly plausible.

For example, an employee might receive an e-mail claiming their direct deposit information had been lost in a system upgrade, and to please e-mail their account numbers and a scanned bank deposit slip to an address in the human resources department. There's little in a message like that to tip off potential victims, even if the phishing attempt is more aggressive -- say, a request to donate to a corporate-sponsored charity by providing credit card data, including a CVV2 number.

Even technically and financially astute people might send sensitive information via e-mail within an organization, assuming the data would never touch public networks such as the Internet. This assumption is even built into the Payment Card Industry Data Security Standard ( PCI-DSS version 1.1), which only requires "encrypt[ed] transmission of cardholder data across open, public networks."

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jon Espenschied

Computerworld
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?