by Mihaela Lica

Created on: May 18, 2007   Last Updated: May 20, 2007

Phishing started around 1996 as a form of stealing AOL dialup accounts and grew into a genuine criminal enterprise. Now phishers target online banking (PayPal, ClickBank, etc) and online commerce (ebay, Amazon, etc) sites. The word comes from "fishing". The "ph" is just a common hacker replacement for "f". And the definition of the word, given by Wordspy is: "Creating a replica of an existing Web page to fool a user into submitting personal, financial, or password data."

Banks and credit card issuers lose annually billions of dollars (and other currencies) because of online phishing, and there is practically no Web user who haven't got at least one phishing email or haven't visited at least one bogus website. Some recognize the fake sites in a flash, others don't even realize how close to a huge financial lost they are and finally the most unfortunate users become phishing victims and, from that moment on, there's not much they can do about it.

There is another key point you need to understand: it doesn't matter how smart you are, how experienced on the Web, whether you are a SEO guru or an IT expert! Your age doesn't matter, nor your educational level! Anyone might become a victim of phishing!

What makes phishing strategies work? How could we possible distinguish a genuine website form a bogus? In their work "Why Phishing Works" Rachna Dhamija of Harvard University and J.D. Tygar and Marti Hearst of UC Berkeley analyse and try to answer the very question "what makes a bogus website credible?". I suggest you go on reading their report to understand how and why some of the most experienced Web users fail to recognize phishing websites and phishing strategies. The study addresses problems such as: lack of computer system knowledge, visual deception (text, graphics, images mimicking windows, windows masking underlying windows, perfect copies of a website layout, etc), lack of attention (especially when it comes to security indicators) and much more.

To understand how phishing works one should go beyond the Wordspy definition and understand what phishing really is. According to the Anti-Phishing Working Group, "Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal consumers' personal identity data and financial account credentials." Creating a replica of a genuine website is just a tool, as tools are the emails sent to your account to make you click on a link that will lead you to the spoof website.

How does

• 1
• 2
• Next Page >>