Friday, 26 October 2007

PayPal and eBay Email Phishing Plummets whilst Cybercriminals Widen Reach

A dramatic reduction has been noticed in the proportion of phising emails targeted at the customers of PayPal and its parent company eBay whilst cybercriminals start targeting the users of a wider range of online companies than ever before in their attempt to steal information and finances including smaller credit card unions, online retailers and firms based in other geographic regions.

A research done by IT security and control firm Sophos showed that in September 2007 only 21 percent of phishing emails purported to come from the two well-known companies. A year ago, 85 percent of these bogus messages claimed to be from eBay or PayPal.

"PayPal and eBay users are much less likely to be targeted by virtual muggers, in part due to the efforts the firms have made in educating their customers about what to look out for, and how to protect themselves. The phishers are not turning away from their life of crime, however. They are now turning to a bigger pool of potential victims,” said Graham Cluley, senior technology consultant at Sophos.

According to Sophos, phishing emails typically point recipients to a bogus website that looks like the real one but is really designed to steal login information such as usernames and passwords. Hackers use the pilfered login details to commit crimes such as identity fraud.

Earlier this year, PayPal introduced an authentication keyfob which created a dynamic password for customers who wanted to reduce their chances of being phished. Additionally, eBay and PayPal have sections on their websites devoted to raising security awareness, and advising customers on how to protect themselves from fraudulent emails. These pages include expert security advice on what a spoof email is, how to recognise one, questions they would never ask of their customers via email, as well as ways that consumers can help fight the overall problem of phishing.

“This is great news, but Internet users should not relax and think the fight is over. Phishers continue to target a wide variety of organisations in their pursuit of easy money," said Cluley.