Good news: 'Phishing' scams net only $500 million

The online cons known as "phishing" have cost U.S. consumers $500 million, according to a study released Wednesday.

In addition, the study found that three-quarters of wired Americans have noticed an increase in phishing incidents during the past few months, with one-third saying they've receiving e-mails sent under fraudulent pretenses at least once a week. The study, sponsored by Truste, a nonprofit privacy group, and NACHA, an electronic payments association, surveyed 1,335 Internet users across the United States.

Phishing scams use e-mails that appears to come from trusted companies to lure people to bogus Web sites, where they're asked to divulge sensitive personal information, such as credit card data. Attacks frequently target bank customers, but recent scams have sought out users of Gmail and Amazon.com.

While the consensus is that attacks are on the upswing, there are disagreements about the severity of the damage. Truste arrived at the $500 million figure by applying the survey's $115 average loss per victim to the general Internet population, spokeswoman Carolyn Hodge said. The tally is for all phishing fraud to date, she said. That finding differs from a Gartner study released in June, which calculated that a whopping $2.4 billion was lost to phishing fraud in a 12 month-period.

At least 70 percent of respondents to the survey, which was conducted by the Ponemon Institute, an Arizona think tank, said they had visited a spoofed Web site. About 15 percent of those people said they had parted with private data such as credit card numbers, checking account information and social security numbers.

A little more than 2 percent of all the people surveyed said they had lost money, in most cases within two weeks of being phished.

Ponemon and Truste said they would approach the Anti-Phishing Working Group, a Washington, D.C.-based trade association, with a call to run a consumer education campaign against such scams.

"As we become more educated on the problem, organizations will be better equipped to develop strategies to address these issues," Larry Ponemon, the institute's founder, said in a statement.

Almost all participants in the survey wanted companies to put in place new technologies to help authenticate e-mail and Web sites.

Antivirus company McAfee said that updates to its spam prevention service and personal firewall software, released Tuesday, will help people combat the problem.

[hadaso]

VARA - Verified And Recipient Authorized email - may eliminate phishing

VARA - Verified And Recipient Authorized email - may eliminate phishing.

It's a scheme planned to verify a sender's identity using the one thing that cannot be "spoofed": the envelope recipient address.

See here: http://wiki.outboundindex.net/VarA

[TimeBomb]

The solution to phishing is...

Don't be an idiot.

Now, isn't that simple? But it is the solution. Oh, I know it won't be the solution to all the people who ARE idiots, but you can't save everyone, now can you?

If someone called you on the phone, said they were from your bank, and asked for your private information, would you give it to them? I'm sure some people would, but those people would be idiots. What if they came to your front door? Would you give them your SSN? I'd hope not.

The same goes for email, or any other medium: If you didn't initiate the contact, then WHY would you assume it's legitimate?

Don't be an idiot.