By now just about every person with an email inbox has been exposed to a phishing scam. Spoofs are showing up with alarming frequency and to make matters worse, criminals have upped the ante with increasingly sophisticated coding and graphics. Gone are the childishly misspelled emails from the High Prince of the Sudan. Advanced techniques leveraging secure phishing servers and high-quality reproductions have contributed to a lucrative criminal enterprise. . . .
By now just about every person with an email inbox has been exposed to a phishing scam. Spoofs are showing up with alarming frequency and to make matters worse, criminals have upped the ante with increasingly sophisticated coding and graphics. Gone are the childishly misspelled emails from the High Prince of the Sudan. Advanced techniques leveraging secure phishing servers and high-quality reproductions have contributed to a lucrative criminal enterprise.

The Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft and fraud that result from the growing problem of phishing and email spoofing. The organization provides a forum to discuss phishing issues, define the scope of the phishing problem in terms of hard and soft costs, and share information and best practices for eliminating the problem. According to the APWG, the average phishing operation nets a 5% return on email spoofs. The percentage is alarming considering millions of addresses are included in a single phishing expedition. If a phisher gets 100 answers to his spoof and successfully scams each one for $100, it's $100,000 easily made.

The demographic responding to phishing scams run the gamut from the overly trusting elderly to college professors too busy to think twice. As Dave Jevans, Chairman of the APWG explains, many instances of phishing victimization are the result of sheer coincidence. He uses the example of a consumer applying for credit with the local bank. The next day the consumer finds a spoofed email in his inbox and thinks it is related to his credit application. Acting dutifully, he provides his personal information.

The link for this article located at net-security.org is no longer available.