The Art of Coarse Phishing

Friday, May 15th, 2009

Recently I received a phishing email that was a cut above the usual sloppy rubbish and even showed a bit of psychological awareness and guile – “If you recently accessed your account while traveling, the unusual log in attempts may have been initiated by you…” However, as always, there were enough tell-tale mistakes – “temporary” rather than “temporarily” – to ensure that most recipients wouldn’t be in any real danger of falling for the scam.

Like most people I’ve tended to take these spelling mistakes and grammatical errors as a reassuring sign of naivety, building a mental picture of the phishers as overseas kids having an amateurish punt rather than ruthless criminals.

But now I’ve changed my mind…

(more…)

Could McAfee (and Firefox) kill spam?

Thursday, April 23rd, 2009

Today I received the most convincing phishing email yet to hit my inbox, to the extent that it inspired enough doubt in my mind that I clicked on one of the links (making sure my security software was up to date first, just in case!).

Why was I fooled? For one, it actually had my name in the email, and for another we as a magazine have been focusing on eBay for the last month or two as part of the investigative cover feature that adorns the current issue (eBay exposed). Could it be some sort of malicious attack from an eBay devotee, a paranoid part of my mind wondered?

(more…)

The world’s least convincing phishing message?

Monday, October 13th, 2008

Hot on the heels of what was quite a reasonable phishing message, this morning I received one that was a little less polished.

It started off quite well, with the mail purporting to come from HSBC bank, and the actual email address was security@hbcs.com, which might just squeeze past some people’s radar.

But what went on with the embedded link? It contains the top-level domain “inhabit.com.au”, which doesn’t sound much like HSBC to me, nor I suspect to anyone who’s technical enough to launch a web browser.

Then again, these things must work or they wouldn’t bother sending them. My question is, has anyone actually received a less convincing phishing message?

Oh, those ingenious swindlers

Wednesday, August 13th, 2008

I thought I’d seen all of the clever methods used by those lovely people who send phishing emails in the hope we’ll click where we really shouldn’t, but today saw a new trick. It still had the tell-tale signs – “Dear customer” not “Dear Tim”, a suggestion that something had gone terribly wrong with my account – but this time the From address looked scarily accurate. Until I looked a little closer, that is.

Ten out of ten for creativity, though.