IN ASSOCIATION WITH

 Home -   Events -   Training 

Phishing dents trust in e-banking: expert
22-02-2006
by Ciaran Buckley

Nearly 60 percent of PC-users receive at least one phishing e-mail every day, which undermines public confidence in electronic commerce and online banking.

The high frequency of phishing e-mails was one of the findings of a new report from SophosLabs, the network of virus, spyware and spam analysis centres run by electronic security specialists Sophos.

The poll, which was carried out among 640 business PC users, found that more than 20 percent of respondents receive more than five phishing e-mails every day.

Although most phishes purport to be from online businesses like eBay and banks, Sophos has also seen messages purporting to be from the US Internal Revenue Service (IRS). But despite the high incidence of phishing, many banks have done little except issue warnings to their customers not to divulge their online banking details.

"It's down to what is most cost-effective," said Carole Theriault, senior security consultant at Sophos, speaking to ElectricNews.Net. "The banks have to weigh the business costs of phishing against the cost of issuing hardware to its customers."

Sophos has responded by developing a phishing alert service that alerts banks when the security specialist's electronic spam nets intercept e-mails directed at the customers of particular financial institutions.

Banks could make it more difficult to hack into customer bank accounts if it introduced biometrics as part of its online security system, but experts say that this could be a very expensive and difficult process.

"The introduction of biometrics is a long way off, because it's a very complex process," said Conor Flynn, technical director at Rits, speaking to ElectricNews.Net.

Flynn said that a number of financial institutions -- such as RaboDirect -- are distributing digital devices to their customers, which generate time-sensitive once-off passwords. Phishing fraudsters could only exploit this information within 60 seconds of the time at which they are generated by the legitimate user.

He said that other institutions -- such as AIB -- are issuing printed once-off password lists, which when combined with the users's PIN, provide a password that is very difficult for a phisher to crack.

From the bank's perspective, the cost of phishing is greater than the amounts needed to compensate gullible customers for the monies stolen from their bank accounts.

"Phishing is more than the occasional nuisance," said Flynn. "It creates mistrust in the system, which means that people continue to transact business through the branches, which means that the bank has to continue to process expensive paper-based transactions."