Article 10 - Phishing

Phishing

No, this is not a spelling mistake, this is the term used for a form of internet fraud and can affect users of Internet banking services in particular. While this should not give cause for alarm, it is something that Internet users should be aware of (I have been using on-line banking services for several years now, and would not like to go back to the older ways of banking).

Before you can use on-line banking services, you have to identify yourself to the bank’s computer. This you do using a combination of an identifier, password and other identifying information. The details vary depending on the bank concerned. However, in all cases, it is essential that you keep all this information totally secret.

The fraudsters start by sending an official looking email containing a link to a web (Internet) address where you are asked to provide user id, password and various other pieces of information. The fraudsters can then use this information to access your bank account. They go to great lengths to make their spoof site look like the official bank site, with a similar sounding name.

How can you avoid being caught out by this sort of fraud?

Be very suspicious of any such emails. The banks do not send emails of this sort to customers, so it is best not to respond, but to notify your bank.
Do not use the link to a web site in such emails. Use your normal way to get to your bank’s site (I have my bank web sites set up in "favourites").
Check what your bank has to say about phishing.
Keep your anti virus software fully up to date.
Make sure that you sign off (or logoff) properly when you finish using the on-line banking facility, rather than simply going to another web site.

Keeping these basic rules should protect you from this sort of fraud. As with everything concerning the Internet, stay vigilant at all times

There was an article in "Computer Weekly" recently, and it seems that the banks are very concerned about the "phishing" problem, and the results of this activity for both the bank and the customer. According to this article, some banks at least are considering refusing access to internet banking unless the customer can show that they have adequate firewall and anti virus protection on their computer.

The banks believe that they have gone to great lengths to warn customers of the dangers of viruses etc., and that people need to take responsibility for their own actions. The banks may also stop indemnifying customers who have suffered a "phishing" attack. A case of fore warned being fore armed.

You may also be interested to know that one (foreign) bank I use has a different procedure which involves the use of their equivalent of a Switch card, and a so-called "calculator". This system does not rely on passwords and other (hopefully) secret information. This approach costs more that the UK approach, but seems to me to be more secure.

The same article in Computer Weekly also stated that Mastercard have started to search the internet looking for stolen credit card details in an attempt to crack down on identity theft. So far, these efforts have resulted in some 1000 sites being closed down, these sites having details of some 35000 credit cards.

It is good to know that something is being done in this area. I also understand that sites which download and install dialers which result in your computer calling a premium rate number are also being closed down – once they have been identified.

Articles