No Phishing

In previous reports we’ve discussed long-term strategies to improve security and prevent unauthorized account access from ID thieves and mass phishers*. While monetary losses from these incursions are relatively small, the bigger issue is lost trust, making it harder to use the online channel profitably. We’ve even heard that a major European bank is considering eliminating all links from its email messages, a move that if widely adopted, would be a major setback to the industry. Before surrendering to the crooks, we recommend some less-drastic approaches involving user education and digital signatures.

We are glad to see banks taking the threat seriously, mounting major user-education effort. However, we caution against overreacting with dire homepage warnings.

Too much emphasis can be just as bad as too little. Statistically, there isn’t a great likelihood that phishing emails will reach their intended victims. Our email address, posted on our website since 1995, receives more than 700 spams per day, but we’ve never seen a fake banking message, although they may have been filtered at our ISP. However, we have received numerous eBay and PayPal fakes.

We are not suggesting you ignore the threat. In the short-term, you must rely on end-user vigilance to prevent damage from phishing. Every financial institution should educate users on the factors influencing email and website safety. We recommend using email messages and a dedicated website security section to do the job. Go easy on the scary homepage messages: a well-placed link to your security section should suffice.

You can be sure the media will do a fine job of creating fear, uncertainty, and dread among your online customers. Your job is to make customers feel more secure, not less.

Jim Bruene, Editor & Founder
jim@netbanker.com

*Mass phishing is sending fraudulent emails to a broad audience hoping to snag a few suckers out of the millions who receive the email. In comparison, a targeted phisher sends a personalized email to a single person, perhaps with knowledge of their card number, or at least the issuing bank, in hopes of gaining additional info.