Online Frauds in Banks with Phishing

First Author's Name: N. P. Singh, PhD
First Author's Title/Affiliation: Professor, Management Development Institute, Gurgaon, India
Postal Address: Mehrauli Road, Sukhrali, Gurgaon -122001, India
Author's Personal/Organizational Website: www.mdi.ac.in
Email: knpsingh(at) mdi.ac.in.
Brief Biographic Description: Dr. N.P. Singh is a Professor of Information Technology Management at Management Development Institute, Gurgaon, India His current research interests are Business Intelligence, Data Warehouse, Data Mining, Enterprise Systems, Application of information Systems in Banking & E-commerce. He has published sixty plus research papers in prestigious journals. He is working on consulting assignments in relation to evaluation of MIS projects, E-governance Projects, Corporate strategy etc.

Visit for more related articles at Journal of Internet Banking and Commerce

Abstract

Hi-tech fraudsters have urbanized a new way of tricking on line banking customers. One such most well known and fast growing technique is phishing. Latest in phishing is application of Trojan horse program. Trojan horse" program insinuates itself into a user's computer via an email and directs the user of the system to website which is exactly similar to financial institution web site. Crooks pick up passwords and account numbers as soon as customer logon to these sites. As it evident from table 1 phishing causes maximum loss to the customers/ institution in comparison to other similar techniques. Keeping in view, the serious threats of phishing attacks author analyzed the trends of major activities of the phishing across globe specifically in the banking sector. In addition, author analyzed the reasons for increase in fishng activities, types of phishing techniques, and process of phishing. Further author has presented recent cases of phishing specifically in banking/ financial sector. Towards the end it author has studied the measures to combat the fishing in online banking.

Keywords

Online Frauds, Phishing Techniques, Anti-phishing tools, Dual factor

Introduction

Online banking is designed mainly to achieve two objectives. First increased convenience for the consumer and second reducing the cost of operations to the banks. Numerous benefits such as lower fee to go online, higher interest rates, online viewing of account details and statement information, pay bills, transfer money between accounts, scheduling automatic periodic payments such as rent or loan payments, applying for accounts or loans and managing loyalty points to achieve first objective. In the process banks are able to reduce cost of operations to some extent. But steep rise in online banking crimes had undermined its success as few bank customers want to return to boring bank queues for secure transactions. Opponents of online banking say that online banking involved heavy risk to the consumers (86% of all attacks are directed at the home users’ agianst 14% at the finanacial houses, Zvomuya (2007)) and industry has rushed to get online without appropriately confronting issues that could compromise its integrity.

The common online banking frauds are (i) Hoax emails (A hoax¹ is an attempt to trick an audience into believing that something false is real), (ii) Computer viruses (A computer virus is a computer program that can copy itself and infect a computer without permission or knowledge of the user), (iii) spyware² ( a computer software that is installed surreptitiously on user computer to intercept or take partial control over the user's interaction with the computer, without the user's informed consent), (iv) Email employment scams / Internet Job Scams ( people are lured by the scammers to visit some websites such as social security statement website³ with a view to steal your information with respect to social security number etc), (v) Identity theft (Identity theft⁴ is a crime in which an imposter obtains key pieces of personal information, such as Social Security or driver's license numbers, in order to impersonate someone else), (vi) Phishing (explained in the next sections), (vii) Vishing (a variant of phishing), and (viii) Eavesdropping⁵ (Unauthorized, real-time access to intelligence) when using a wireless connection.

In the recent past, according to the UK payments association Apacs⁶, the huge rise in online banking fraud coincides with an upsurge in the number of phishing scams being run on the web and demonstrates the importance of educating bank customers about this type of crime. The similar concern is raised by Financial Services Autority (FSA), UK reglator. FSA recoreded 8.000% increase in online banking frauds and identified phishing as major instrument (OUTLAW News (2006)). Jaques (2006) reported that a quarters of Britons have disxclosed their PIN to some one else, exposing themselves to risk of fraud. Another facts revealved by users that they use similar PIN for all their on average four cards. Young (2006) mentioned that online bank fraud losses rose by 55 per cent from £14.5m in the first six months of 2005 to £22.5m in the same period in 2006 as per the release of Apacs and phishing scams are major contributor. Miller (2007) identified trends of phishing in 2006. He pointed out six innovations of phising. These are (i) Plug and Play Phishing Networks (phishers perfected techniques to rapidly deploy entire networks of phishing sites on cracked web servers. The software used are known as Rockphish and R11) (ii) Phlashing (Flash-based phishing sites) (Attackers have begun using Flash animation to create spoof sites as a strategy to defeat automated anti-phishing services), (iii) Two-factor Authentication (able to defeat two-factor authentication tactics using a man-in-the-middle attack), (iv) Hacked Bank Sites (Several attacks in 2006 saw phishers hack into bank web servers and use them in attacks), (v) Continued XSS Vulnerabilities (exploiting financial institutions web site vulnerability to attacks using cross-site scripting (XSS), (vi) MySpace Phishing (targeting social networks). With the growth of phishing customers are realizing that online transactions in particaular e-commerce transactions are not safe. Phishing is becoming so widespread, its variations are taking on cute names. In the initial years it used to be limited to the largest banks, but a new twist, called 'puddle phishing' has the fraudsters going after the customers of regional banks or credit unions. Phishing which targets small groups or individual companies is known as 'spear phishing'. In addition, vishing, pharming, man-in-the-middle attacks variants of phisning are also becoming common to the victms.

This article is an attempt to analyse various facets of phishing with the help of secondary data available on internet and in the literature. Various views of phishing are explained in the definitions of phishing presented in the next section of the article. The four major phishing techniques are briefed in section 3. The main reasons for increase in fishng activities are detiled in section 4. Recent statistics/ cases of phishing in general and phishing for banking frauds are detailed in section 5 of this article. Short duration historical analysis of Indian financila institutions is detailed in section 6. Towards the end, section 7 incudes the various measures to combat the phishing in online banking followed by concluding remarks. The article is based on secondary data mainly collected from the internet or from published reoprt. Conclusions are the result of qualitative analysis in temrs of new development of phishing domain and couter measures by the victims.

What is phishing?

It is derived from fishing. Phishing (also called brand spoofing) is a term used for a short of fraud where phishers send out spoof email to a random database to fool the recipient in to divulging personal information like credit cards details, usernames and passwords, that can be used for identity theft. Phishing is one of the most well known and fastest growing scams on the Internet today. The typical phishing scam involves an e-mail that appears as though it came from a reputable and known service institutions or company. The e-mail appears to be legitimate and the actual one. The message generally indicates that, due to problems in the institution (bank in this case) such a database updates, problem occurred in server, security/identity theft concerns, the recipient is required to update personal data such as passwords, bank account information, driver's license numbers, social security numbers, Personal Identification Numbers (PIN), and so forth. The e-mails include warning to the users that failure to immediately provide the updated information will result in suspension or termination of the account etc. Some of explanations of the word in the form of definition are listed in the following:

Definition 1⁷: In computing, phishing is a criminal activity using social engineering techniques. Phishers attempt to fraudulently acquire sensitive information, such as usernames, passwords and credit card details, by masquerading as a trustworthy entity in an electronic communication. eBay and PayPal are two of the most targeted companies, and online banks are also common targets. In computing, phishing is a criminal activity using social engineering techniques. Phishers attempt to fraudulently acquire sensitive information, such as usernames, passwords and credit card details, by masquerading as a trustworthy entity in an electronic communication. eBay and PayPal are two of the most targeted companies, and online banks are also common targets.

Definition 2⁸: The act of sending an e-mail to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft

Definition 3⁹: Phishing means sending an e-mail that falsely claims to be from a particular enterprise (like your bank) and asking for sensitive financial information.

Definition 4¹⁰: Phishing is a type of fraud that is designed to trick individuals into disclosing confidential and financial information for the purpose of identity theft.

Another variant of phishing is Vishing (voice-phishing). It is the practice of sending fraudulent email to consumers that appears to be an email from a local bank, credit union or other financially related web site and contains what appears to be a local phone number. The fraudulent email will appear to inform the consumer of some type of problem with their account and instruct them to dial a local phone number. Consumers who are used to calling automated tellers are being tricked into using their phone keypad to type in vital account numbers, pin numbers, and other financial information into overseas computers (Baker (2007)).

Phishing Techniques

There are mainly three techniques of phishing as mentioned by ITU (2005). However, one more technique is reported by Chawki (2006). These techniques are briefed in the following:

i. Dragnet Method: This method involves the use of spammed emails, bearing falsified corporate identification (e.g., trademarks, logos, and corporate names), that are addressed to a large class of people (e.g., customers of a particular financial institution or members of a particular auction site) to websites or pop-up windows with similarly falsified identification to trigger immediate response.

ii. Rod-and-Reel method: This method targets prospective victims with whom initial contact is already made. Specific prospective victims so defined are targeted with false information to them to prompt their disclosure of personal and financial data.

iii. Lobsterpot Method: It consists of creation of websites similar to legitimate corporate websites which narrowly defined class of victims by phishers. Smaller class of prospective victims identified in advance, but no triggering of victim response. It is enough that the victims mistake the spoofed website as a legitimate and trust worthy site and provides information of personal data.

iv. Gillnet phishing: In gillnet phishing; phishers introduce malicious code into emails and websites. They can, for example misuse browser functionality by injecting hostile content into another site’s pop – up window. Merely by opening a particular email, or browsing a particular website, Internet users may have a Trojan horse introduced into their systems. In some cases, the malicious code will change settings in user’s systems, so that users who want to visit legitimate banking websites will be redirected to a look alike phishing site. In other cases, the malicious code will record user’s keystrokes and passwords when they visit legitimate banking sites, then transmit those data to phishers for later illegal access to users’ financial accounts.

Reasons For The Increase In Phishing

i. The tool such as “Universal man-in-the-middle phishing kit” which automatically creates sophisticated phishing site is available on underground online market places for about $1000. (Evers (2007) & Dunn (2007)).

ii. Availability of key-logging software which can surreptitiously record key-stroking activity and collect computer usernames and passwords. (News (2003).

iii. Customers are lured by fictitious rewards for participating in bogus surveys and handover sensitive account information to phishers (Leyden (2006) and Miller (2006)).

iv. Some of the organizations employ lax password requirements. For example eBay allowed combinations such as user ID of james34231 and a password of james34. The similar combinations are also allowed by Google mail (Goodin (2007)).

v. Another reason for increase in phishing is very high return on investment. According to Lohman (2006) “The return on investment in phishing is phenomenal.” “It costs about $160 to set up a phishing scam to send 10,000,000 emails a month. Even if only 0.001 percent of the emailed people respond, it nets about $125,000.”

Phishing Cases

Globally, about 30,000 phishing attacks are reported each month, of which over 80% are directed at financial institutions. Statistics presented in table 5 is an ample proof of sharp increase in phishing activities. Phishing attackers have targeted at financial entities such as Citibank, Wells Fargo, Halifax Bank, eBay, and Yahoo as reported by Secure Science Corporation (2003). The details of top 10 brands affected by phishing are presented in table 8 indicates that eBAy and Paypal are favaorite of phisher during the last five years. According to assureconsulting.com¹¹, phishing is an complex and converging security threats facing businesses. The methods used by spammers have become more sophisticated, and spam is now increasingly combined with malware and used as a tool for online fraud or theft, or to propagate malicious code. Assureconsulting.com reported a set of three examples using phishing for financial frauds targetted on financial entities, internet servocice providers, retailers such as Citibank, U.S. Bank, Paypal, Visa, AOL, Nationwide, Chase, MSN, and Yahoo. McAfee¹² says that phishing schemes and identity theft will continue to be a problem among the consumer community until further education and widespread acceptance of proactive protection occurs. According to Thomas (2006), the survey by RSA Security reveals that 62 per cent of all phishing scams were aimed at US banks and credit unions, while the number of identity fraud attacks against European and other financial institutions dropped. Table 1 embodies a brief description of few phishing cases as reported in the literature with respect to financial institutions along with general statistics of phishing. These cases includes only those cases wherein amout stolen by phishers is mentioned.

As mentioned earlier phishing is not only confined to the banking institutions but targets other organizations which are involved in e-commerce, mobile commerce and money transfer activities. Few popular cases are described in table 2.

Phishing In India

In India there have been several cases of attacks35 on genuine websites. Financial institutions are the main targets of phishers, particularly, private banks. The major incidents are reported about ICICI, HDFC, UTI, and Stat bank of India. Many elderly customers who have just begun using online facilities of the financial institutions are falling prey to phishers. The messages send to customers are similar to as one given in the following which was sent to ICICI customers.

“The mail reads that the ICICI bank is upgrading to a new SSL Server to insulate customers against online Identity Theft and other criminal activities. Users are told to confirm their personal banking information following the link given in the mail. It also warns that if the user does not complete the form, the online bank account will be suspended till further notification36”.

As mentioned in the beginning phishing incidents are increasing around the world in all aspect. May it be number of phishing e-mail reported, number of phishing hosting sites, amount lost in phishing attacks etc. The analysis of these parameters of phishing with respect to India is presented in the following. These facts are about for the year 2005 to 2007.

It is evident from the data presented in table 3 and 4 that India had figured six times/ months among top 10 phishing hosting countries in the 25 months that is from January, 2005 to January, 2007. However percentage contribution is not very high in comparison to leaders USA and China in this domain. In addition specific researches are available with respect to phishing attacks on Indian financial institutions. Kaur (2005) pointed out that over 1,000 cases of phishing are reported in three months-from Dec '04 to March '05 in spite of RBI guidelines on Internet banking which enforces the adoption of internationally accepted state-of-the-art minimum technology standards for access control, encryption/decryption (minimum key length), firewalls, verification of digital signature, and Public Key Infrastructure (PKI). There are lots of investments by banks in security domain. According to the 2005 DQ-IDC Mega Spenders survey, Punjab National Bank topped the investment list. Its web servers are provided with Digital Certificates and are SSL enabled. Customers are forced to change the passwords at periodic intervals and a virtual keyboard feature has been provided for Internet Banking login, whereby the customer uses mouse clicks instead of typing using the keyboard. This minimizes the risk of keyboard grabbing but still many phishing are reported. ‘2005 India Web@work’, a survey conducted by Websense Inc revealed that 32% of employees in India admitted to have given out their confidential data such as credit card numbers and corporate network passwords as a result of phishing attacks and 62% of IT managers believe that a security breach would put their jobs at risk (corporate Bureau (2005)).

Banking sources indicate that besides SBI, three other international banks have informed Computer Emergency Response Team- India (CERT-In) about attempts at phishing during 2006. CERT-In reported that phishing incidents in 2006 were 180 per cent higher than 2005, and that trend has carried through into 2007 (Gold (2007)) and it has reports that 335 sites were targeted in 2006. Incidentally, 256 out of 335 were from the e-commerce segment (Cherian (2007)). Interestingly, CERT-In said it has recorded more consistent phishing incidents in the second half of 2006. The agency said there were close to 30 incidents recorded every month between July to October, 2006, 62 per cent of which involved phishing (against 25 per cent in 2005) and 32 per cent of which involved network scanning (against 30 per cent in 2005).

Kumar (2006) pointed out that it has been six months since the phishing attack on ICICI bank customers became public, and during that period, two more such attacks were reported on customers of financial institutions in India, one of UTI Bank and the other, State Bank of India. He had mentioned, considering that `phishing' was pretty much unheard of in India a year ago, this frequency is something to be concerned about. Paul (2006) reported that in addition to ICICI, UTI, and SBI, the other financial organizations such as IDBI, ICICI Bank Home loans, HSBC, Standard Chartered, ABN personal loans, Bank of India and Kotak-Mahindra too have their phishing sites.

According to statistics presented by Espiner (2007) phishing attacks have outnumbered e-mails infected with viruses and Trojan horse programs during January 2007. Survey37 conducted between January and March 2007 by Websense, Inc., reveals that 57% of the Indian enterprises have received phishing lures during the last one year and over a third of Indian companies (38%) were attacked by spyware. This is based on a sample of 450 Indian CIOs. Ghosh (2007) mentioned that more than 74% of IT managers across India report that their employees have received phishing attacks via email and about 52% say that their PCs have been infected by phishing. RSA Consumer Solutions reported that globally, phishing attacks have grown by 41% in the past 12 months and Phishers could convince up to 5% of recipients to respond. Few cases of phishing of major three banks (State Bank of India (SBI), ICICI, Unit Trust of India (UTI Bank)) of India are given in table 3.

How To Combat Bank Fraud

There are many methods to combat bank frauds in general and phishing in particular. In India alert and conscious customers could avoid phishing attacks. Most of the financial institutions are educating their customers of regular basis about phishing websites. In addition to these educative e-mails from the institutions the following three category measures can reduces frauds with phishing. Category I includes measures for customers, category II includes induction of new technology, and last category III includes measures on part of the institutions.

Category I

i. Never share your password (Security related information) under any circumstance. (Standard Bank, Zvomuya (2007))

ii. Never click on an e-mail that is purportedly from a bank advising you for updated antivirus software, and which can be downloaded from the bank’s website. (Standard Bank, Zvomuya (2007))

iii. Browse the bank’s notification system on regular basis so that one can see the activities of his/her account. (Standard Bank, Zvomuya (2007)).

iv. When ever one wants to visit the website of the bank, type full URL or web address. It is secure. It will avoid the logon to spoof sites such as http://www.citbank.com for http://www.citibank.com, and www.idbiibank.com for www.idbiibank.com.. (Standard Bank, Zvomuya (2007)).

v. It is not safe to do internet banking in wireless internet environments or at Internet café. (Standard Bank, Zvomuya (2007)). It should be avoided out rightly.

vi. Continuously read the posting of your banker for security updates. For example Zion bank46 postings

vii. Never access Online Banking via a link47. Rather type the address directly into the browser address bar.

Category II

i. Use browsers such as Firefox 2, Opera and Internet Explorer 7 (all latest versions) which include phishing shields (Kurup (2007)) and has better anti-fraud features in comparison to others (Matthew (2006)).

ii. Banks must implement anti-phishing programs as implemented by HSBC in Hong Kong48. Security firms such as Symantec and McAfee are marketing anti-phishing software’s. Bank must install security software’s from Symantec Corp and McAfee Inc49. There are many more companies which either developing or marketing anti-phishing solutions. These solutions can safegarud banks /financial institutions against fishing. Few of these solutions providers are mentioned in the following for the sake of examples.

a. NTT Comware50 said Tuesday it has begun marketing PHISHCUT, a solution method for preventing phishing.

b. India’s premier customized software solutions company, HQ, New Delhi51 partnered with Cloudmark Inc., to provide ant-spam and anti-phishing products/ solutions to Indian SMB’s and ISPs.

c. Aladdin Knowledge Systems52 , the leader in Software DRM, USB-based authentication, and secure Web gateways, today announced that Mumbai-based SecureSynergy Pvt Ltd is the first managed security service provider in India to deploy the Aladdin eSafe SecureSurfing solution for its customers.

d. Sendmail53, leading global provider of trusted messaging has launched Domain Keys Identified Mail (DKIM) authentication technology in the company’s Sentrion security appliances, and also in the commercial Sendmail Switch and Open Source mail servers. Sendmail’s latest announcement concurs with the Internet Engineering Task Force (IETF) approval of DKIM as an Internet Standard. By verifying incoming messages organizations can remove targeted spoofing and phishing threats, cut on the number of false positives and remove identifiable spam.

e. Replace username and password login with stronger Hardware-based authentication solutions that are still current and viable as suggested by majority of customers in USA (Bennett (2006)). Similar suggestions are reported by the online survey, conducted in December 2006 by RSA. They also suggested risk based authentication. The sample size was 1,678 adults from eight countries including India (Pradhan (2007)). In fact Bendigo Bank is the first Australian banks to offer customers strong authentication protection for Internet banking using password generating tokens, in a move to thwart Internet banking fraudsters (Dinham (2004)). The cost of the tokens is AU$16.50 each.

iii. Fast-moving, adaptable threats require equally agile, multi-faceted security responses. There are different technologies that provide multi-factor authentication, and banks must seriously consider the implications of each in terms of cost, ease of deployment and potential impact on usability (Bennett (2006)).

iv. Introduction of electronic signatures to all email correspondence with its customers to curb phishing as it was done by German bank Postbank (Libbenga (2006)).

v. Password shall be replaced with can be replaced with biometric technology.

Category III

i. Transfer malicious mails to government agencies54, which take care of such e-mails. For examples- uce@fte.gov, spam@uce.gov in USA. (Hall (2006), Indian Computer Emergency Response Team (CERT-In)

ii. Citibank recently reduced the amount of money it allows customers to transfer out of checking accounts in response to the phishing epidemic. Daily limits on the institution's Global Transfers program, which allows customers to move money to any Citibank account for $5 or $10 per transfer, were reduced to $500 per day and $1,000 per week in October. This practice can be followed by others.

iii. Minimize or eliminate the risks by instead using a virtual card with a virtual number for one-time use, with a specified limit and validity period—in many ways, this option is even safer than using a physical credit card in the real world. I’ve found that HDFC Bank’s NetSafe55 facility serves this purpose quite adequately, and in the rare event that your virtual card does get misused, your liability, if any, would be a very limited one indeed.

iv. Banks should monitor every online transaction—not just log-in, but throughout the entire online banking session and telephone banking sessions (Bennett (2006) and (Pradhan (2007)).

In India, ICICI bank had adopted a dual factor authentication practice and remodeled its debt cards which now have 8X2 grid of numbers on the back of their debit cards. HDFC bank adopted a three pronged approach to tackle phishing (i) continuous education of customers about online transactions security, (ii) setting up a robust incident response process to render attacks harmless, (iii) implementing state of art technology solutions to thwart phishing attacks.

Conclusion

There is a sharp rise in phishing statistics as it evident from the values in various tables. May it be number of hosting of phishing sites, or mails received about phishing, monetary loss either of the customers or of organizations. The main reason for losses/ success of frauds is ignorance on part of customer as well as service providers (bankers, ISPs, retailers etc). It requires stringent methods of educating customers and regular review of security related information of individual customers. For example:

i. Customer should not be allowed to be the customer of financial institutions unless they read security related concern properly and provide a proof to the institutions that they are aware of security concerns. This could be done by pushing terms and conditions of being customer in pieces and unless customer runs though all pieces of information his/her application should not be accepted for being a customer. It will certainly act as an stumbling block to have more customer but new innovative methods can be devised so that customer did feel heat of these measures.

ii. Let us take an example of ICICIdirect.com web sites in India. It has policy, which forces its clients changing of password after 15 days. It start reminding the customer that within next two days customer had to change password otherwise transactions will not be allowed. It is being followed at ICICIdirect.com religiously. But at the same time if one operate his/her saving bank account with ICICI Bank, he/she can continue with his/her password, which is only of four digits for ever. The question is why not the same policy for saving bank or any other account of the bank.

iii. There are many cases reported in the past with reference to inadequate characters of password in terms of sequencing and number. The institutions may devise a policy of secure password in terms of sequencing the characters or characters it self. In addition, policy must take care of size of the security related data. In addition, institution may analyze the pass word data base on regular interval for inadequacy and it may be communicated to the customers on real time basis.

iv. International fund/ large fund transfers should not be on real time basis. As a part of term and conditions, customers must be informed before the transfer take place. Duration of execution of the transaction may be 24 hours/36 hours or as deemed fit by the financial institution.

v. The information on incidents of phishing or similar serious crime should be made available to the citizens as early as possible and also out come of judicial process. In addition, new regulations must be made available through electronic means to all the citizens/ customers.

vi. Many organizations (Software developers or implementers) have developed anti-phishing solutions, the usage of these security tools may be encouraged through regulations. In addition, small organizations should be supported by states in making their electronic transactions secure.

vii. There is a need for better, easy to use and cost effective methods of authentication of customer transactions.

viii. To fight phishing, institutions must adopt a multi-pronged approach with minimum four components. (a) usage and development of new technologies to counter frauds, (b) educating customers with riders every where, (c) helping law reinforcement agency by way of providing information of the incidents, and (d) proper and regular stringent audit of online systems.

1 http://en.wikipedia.org/wiki/Hoax

2 http://en.wikipedia.org/wiki/Spyware

3 http://www.identitytheftfixes.com/identity_theft_can_cost_you_more_than_just_your_credit_score.html

4 http://searchsecurity.techtarget.com/sDefinition/0,290660,sid14_gci801871,00.html

5 http://www.spybusters.com/eavesdropping_definition.html

6 http://www.bcs.org/server.php?show=conWebDoc.10452

7 http://en.wikipedia.org/wiki/Phishing

8 http://www.webopedia.com/TERM/P/phishing.html

9 http://inhome.rediff.com/money/2004/dec/20spec.htm

10 http://www.rbc.com/security/bulletinPhishing.html

11 http://www.assureconsulting.com/articles/phishing.shtml

12 http://www.networkmagazineindia.com/200409/securitywatch01.shtml

13 http://sify.com/news/infographics/onlinescams/scam2/index.php

14 http://www.sda-india.com/sda_india/psecom,id,24,site_layout,sdaindia,analysis,201,p,0.html

15 http://www.svbizlaw.com/phishing.wachovia.htm

16 http://www.eco.de/servlet/PB/show/1858849/Schwenk_ai3.pdf

17 http://www.chosensecurity.com/solutions/anti_phishing.htm

18 http://computertimes.asiaone.com.sg/news/story/0,5104,2808,00.html

19 http://www.ioltechnology.co.za/article_page.php?iSectionId=2885&iArticleId=3751820

20 http://domainsmagazine.com/Domains_14/Domain_2780.shtml

21 http://www.cs.tau.ac.il/tausec/lectures/AntiPhishingil.pdf

22 http://www.theage.com.au/news/Breaking/Phishing-attack-nets-over-

23 http://news.bbc.co.uk/2/hi/uk_news/england/lancashire/4396914.stm

24 http://www.abanet.org/adminlaw/annual2004/Phishing/PhishingABAAug2004Rusch.ppt#10

25 http://www.abanet.org/adminlaw/annual2004/Phishing/PhishingABAAug2004Rusch.ppt#10

26 http://www.businessweek.com/magazine/content/05_22/b3935009_mz001.htm

27 http://findarticles.com/p/articles/mi_pjus/is_200311/ai_1464826283/pg_14

28 http://findarticles.com/p/articles/mi_pjus/is_200311/ai_1464826283/pg_15

29 http://www.itu.int/ITU-D/e-strategies/e-legislation/Doc/Cybercrime_M_Menting.pdf

30 http://findarticles.com/p/articles/mi_pjus/is_200311/ai_1464826283/pg_15

31 http://www.abanet.org/adminlaw/annual2004/Phishing/PhishingABAAug2004Rusch.ppt#12

32 http://asia.news.yahoo.com/060207/kyodo/d8fk4i588.html

33 http://www.sophos.com/pressoffice/news/articles/2006/05/jpphishgang.html

34 http://en.wikipedia.org/wiki/Phishing#_note-76

35 http://www.ciol.com/content/search/showarticle1.asp?artid=84504

36 http://www.mwti.net/products/pdfs/theitshield_ICICI%20Bank%20Phishing%20Scam% 20Targets% 20Customers%20In%20India.pdf

37 http://www.moneycontrol.com/india/news/pressnews/60-india-inc-believed-to-have-recd-phishing-lureswebsense/281565

38 http://www.websense.com/securitylabs/alerts/alert.php?AlertID=702

39 http://infotech.indiatimes.com/Enterprise/Be_web_wary_Phishing_hits_SBI_3_other_banks_/ articleshow/461978.cms

40 http://www.realinformationsecurity.com/general/rbi-seeks-data-from-banks-on-frauds.html (2007, March)

41 http://www.pegasusinfocorp.com/resources/articles/what_is_phishing.html

42 http://www.moneycontrol.com/india/news/investigation/phishingpeoples-accounts/08/14/260119

43 http://www.mouthshut.com/review/UTI_Bank-116456-1.html

44 http://www.dqindia.com/content/industrymarket/focus/2007/107051005.asp

45 http://www.spamrazor.net/news.htm

46 http://www.zionsbank.com/online_fraud.jsp

47 https://www.fnb.co.za/

48 http://www.chinatechnews.com/2005/06/16/2618-hsbc-starts-anti-phishing-program-for-hong-kong-customers/

49 http://www.businessweek.com/magazine/content/05_22/b3935009_mz001.htm

50 http://www.japantoday.com/jp/news/402016

51 http://www.synapse.co.in/cloudmark/cloudmark-anti-spam-phishing-india.html

52 http://www.google.co.in/search?q=phishing+in+india&hl=en&start=250&sa=N

53 http://www.techshout.com/security/2007/24/new-standard-combating-email-fraud-and-phishing-being-adopted-by-sendmail/

54 http://blogcritics.org/archives/2005/03/02/101711.php

55 http://www.expresscomputeronline.com/20040823/opinion01.shtml

56 http://www.antiphishing.org/

57 http://www.antiphishing.org/phishReportsArchive.html

58 http://www.antiphishing.org/phishReportsArchive.html

References

1. Anderson, R. (2007). Closing the Phishing Hole – Fraud, Risk and Non-banks, http://www.cl.cam.ac.uk/~rja14/Papers/nonbanks.pdf
2. Baker, T.D. (2006). New email-based bank fraud via VOIP services, 07/21/06, http://www.xeal.com/blog/index.php/2006/07/21/new_email_based_bank_fraud_via_voip_serv
3. BBC (2006a). Online banking fraud rises fast, Tuesday, 7 November 2006, 00:04 GMT, http://news.bbc.co.uk/1/hi/business/6122116.stm (Accessed on 07.04.07).
4. BBC (2006b), Online banking fraud 'up 8,000%', Wednesday, 13 December 2006, http://news.bbc.co.uk/2/hi/uk_news/politics/6177555.stm,(Accessed on 07.04.07).
5. Bennett, N. (2006). Need for stronger authentication, June, 2006 http://www.networkmagazineindia.com/200606/vendorvoice01.shtml
6. Business News (2007). India in the list of 10 top countries hosting phishing websites, http://in.news.yahoo.com/070216/203/6c73r.html
7. Chan, T. (2004). HK$660,000 stolen in e-bank scam, October 8, http://www.chinadaily.com.cn/english/doc/2004-10/08/content_380368.htm
8. Chauki, M. (2006). Phishing in Cyberspace: Issues and Solutions, http://www.crime-research.org/articles/phishing-in-cyberspace-issues-and-solutions/
9. Cherian, J. (2007). Phishing up 180% in India, http://www.allheadlinenews.com/articles/7006315133
10. Colley, A. (2004). "Most devious" bank email phishing scam discovered, 4 March, http://www.silicon.com/software/security/0,39024655,39118902,00.htm
11. Corporate Bureau (2005). 74% IT managers receive phishing attacks, http://www.financialexpress.com/fe_full_story.php?content_id=98848 (Accessed on 08.04.07).
12. Costello, T (2004). Crooks clean out couple’s online bank account, December, 14, http://www.msnbc.msn.com/id/6713753/
13. Devillard, A. (2006). The “phishing” in France, few victims but a growing threat, http://translate.google.com/translate?hl=en&sl=fr&u=http://www.01net.com/article/311785.html&sa=X&oi=
    translate&resnum=1&ct=result&prev=/search%3Fq%3DPhishing%2Bin%2BFrance%26hl%3Den
14. Dinham, A. (2004). AU regional bank signs up for anti-phishing tokens, http://www.zdnet.com.au/news/security/soa/AU-regional-bank-signs-up-for-anti-phishing -tokens/0,130061744,139152762,00.htm JIBC, August 2007, Vol. 12, No.2 - 24 -
15. Dunn, J.E. (2007). Do-it-yourself phishing kit available online, January,15, http://www.pcworld.in/news/index.jsp/artId=4915203
16. Espiner, T. (2007). Phishing overtakes viruses and Trojans, January, 31, http://zdnetindia.com/news/security/stories/169631.html
17. Evers, J. (2007). New tools enables sophisticated phishing scams, January 11, http://zdnetindia.com/news/security/stories/167392.html
18. Frederick Stakelbeck, Jr. (2005). China and e-Banking, www.inthenationalinterest.com/ Articles/November2005/November2005Stakelbeck.html
19. Ghosh, A. (2007). Banks alert to online fraud, to stay ahead of phishers, The Economic Times, New Delhi Friday 6 April, 2007.
20. Gold, S. (2007). Phishing incidents soaring - in India, January, 31, http://securityblog.itproportal.com/?p=698
21. Gooden, Dan (2007). Man hijacks 90 eBay accounts, March 21st, http://www.theregister.co.uk/2007/03/21/ebay_hijack_plea/
22. Hall, B. (2007). Phishing Out Internet Banking Fraud, January 29, http://ezinearticles.com/?Phishing-Out-Internet-Banking-Fraud&id=435269.
23. ITU (2005). Research On Legislation In Data Privacy, Security And The Prevention Of Cyber-crime, http://www.itu.int/ITU-D/e-strategies/e-legislation/Doc/ Cybercrime_M_ Menting.pdf
24. Jaques, R. (2006). Phishing scams push up web banking fraud losses, 8 November 2006, http://business.pcauthority.com.au/news/67988,phishing-scams-push-up web- banking-fraud-losses.aspx
25. Jeremy Kirk (2006). Online banking fraud dramatically jumps in the U.K, November 08, 2006, http://www.computerworld.com/action/article.do? Command =viewArticleBasic &articleId=9004889&intsrc=article_more_bot.
26. John, P. (2006). Other banks caught in phishing net too, February 12, http://www.indusfaceconsulting.com/corporate/12feb06_news.htm
27. Kasbekar, M. (2007). How thieves rob you online, January 20, http://inhome.rediff.com/money/2007/jan/20thief.htm
28. Kaur, J. (2005). Are You Being Phished?, http://www.dqindia.com/content/enterprise/ 2005/105060702.asp
29. Kobayashi-Hillary, M. (2006). Data theft scandal - what we can learn from India, http://services.silicon.com/offshoring/0,3800004877,39163049,00.htm?r=2. JIBC, August 2007, Vol. 12, No.2 - 25 -
30. Krupp, P. (2007). Banks should divulge phishing details to the customers, January 4,http://www.cxotoday.com/India/Editors_Speak/Banks_should_divulge_phishing_details_ to_customers/551-78253-904.html
31. Kumar, D. (2007). `Phishing' for trouble, Jan 20, 2007, http://www.hindu.com/thehindu/mp/2007/01/20/stories/2007012000380200.htm
32. Leyden J. (2005). Brazilian cops net 'phishing kingpin', March 21, http://www.theregister.co.uk/2005/03/21/brazil_phishing_arrest/
33. Leyden, J.(2006a). AOL sues mystery phishers for $18m, March 1, http://www.theregister.co.uk/2006/03/01/aol_phishing_lawsuits/.
34. Leyden, J. (2006b). Phishing fraudsters offer cash reward, 14th March, http://play.tm/wire/click/824881
35. Libbenga, J. (2006). German Postbank uses e-signatures to curb phishing, April, 7, http://www.theregister.co.uk/2006/04/07/postbank_curbs_phishing/
36. Libbenga, J. (2007). Phishers haul in money from Nordic bank, January, 19, http://www.theregister.co.uk/2007/01/19/phishers_attack_nordea/
37. Lihle Mtshali (2007). Rise in online banking fraud, 29 March 2007, http://www.sundaytimes.co.za/News/Article.aspx?id=424637.
38. Lohman, T. (2006). NAB hit by phishing scam, March 9, http://www.itnews.com.au/newsstory.aspx?CIaNID=30742
39. Matthew B. (2006). Firefox 2 Tops IE 7 in Anti-Phishing Study, November,16 http://www.pcworld.in/news/index.jsp/artId=4685844
40. McMillan, R. (2006). Consumers to Lose $2.8 Billion to Phishers in 2006, November 09, http://www.pcworld.com/article/id,127799-pg,1-RSS,RSS/article.html
41. Miller, R. (2006). Chinese Bank's Server Used in Phishing Attacks on US Banks, InfoSec News, Sun, 12 Mar 2006, http://news.netcraft.com/archives/2006/03/12/chinese_banks_server_used_in_phishing_attacks_on_us_banks.html.
42. Miller, R. (2007). Phishing attacks continue to grow in sophistication. http://news.netcraft.com/archives/2007/01/15/phishing_attacks_continue_to_grow_in_sophistication.html
43. Mulherkar, J. (2006). How to escape phishing in online banking, February 15, 2006, http://in.rediff.com/getahead/2006/feb/15bank.htm
44. Nair, V.P. (2004). However careful you are..., Jul 12, 2004, http://www.blonnet.com/ew/2004/07/12/stories/2004071200010100.htmJIBC, August 2007, Vol. 12, No.2 - 26 -
45. Nayak, A. (2007). Identify thefts & “phishing” within Indian BPO employees, http://www.bpoindia.org/research/identity-theft-indian-bpo.shtml
46. News (2003). Spyware bank frauds uncovered in US and South Africa, http://www.finextra.com/fullstory.asp?id=9511
47. Norah, L. (2004). Phishing gang arrested in Germany, December, 18, http://itvibe.com/news/3094/
48. O’Brien, C. (2006a). BoI Customers fall victim to phishing scam, August, 17, http://www.theregister.co.uk/2006/08/17/boi_phishing_attack/
49. O’Brein, C. (2006b). Bank of Ireland coughs up for phishing victims, September, 8, http://www.silicon.com/financialservices/0,3800010322,39162206,00.htm
50. OUT-LAW News (2006). FSA blames phishing for growth of online banking fraud, 18/12/2006 http://www.out-law.com/page-7582.
51. PC Tools News (2006). PC tools isuues Internet fraud warning after Swedish bank loses $ 1.5 Million, Janury, http://www.pctools.com/news/view/id/159/
52. Pradhan, P. (2007). Survey shows on line banking needs changes, January, 29 http://www.tech2.com/india/news/general/survey-shows-online-banking-needs-changes/3987/0
53. Reuters (2007). Online banking fraud soars 44 per cent – APACS, March, http://www.pcpro.co.uk/security/news/107226/online-banking-fraud-soars-44-per-cent-apacs.html
54. Reuters (2004). "Phishing" scam now lures German banking clients, August, http://in.tech.yahoo.com/040826/137/2fpm6.html
55. Robert, P.F. (2005). UK Phishers Caught, Packed Away, http://www.eweek.com/article2/0,1895,1831960,00.asp
56. Rondganger. L. (2007). Online bank fraud hits three banks, 27 March 2007 at 11h00, http://www.ioltechnology.co.za/
    article_page.php?iSectionId=2885&iArticleId=3752066 (Accessed on 07.04.07).
57. Rupert J. (2007). Good catches for 'phishing' fraudsters as losses through fake bank websites leap 44% to £34m, March 14, 2007, http://business.guardian.co.uk/story/0,,2033243,00.html
58. Saytarly, T (2004). Phishing costs $20 000 000 for Russian businesses, October 14, http://www.crime-research.org/news/14.10.2004/707/
59. Secure Science Corporation (2003). Banking Scam Revealed, November 13, http://www.securityfocus.com/infocus/1745 JIBC, August 2007, Vol. 12, No.2 - 27 -
60. Sullivan, B. (2004a). Survey: 2 million bank accounts robbed, ET June 14, 2004 http://www.msnbc.msn.com/id/5184077/
61. Sullivan, B. (2004b). Online bank fraud concerns consumers, ET Dec. 14, 2004 http://www.msnbc.msn.com/id/6713033/
62. Thomas D. (2005). Phishers jailed over £6.5m identity fraud, June, http://www.vnunet.com/computing/news/2139095/phishers-jailed-identity-fraud
63. Thomas, D. (2006). Phishing attacks against Europeans drop, 14 June, 2006, http://www.computing.co.uk/computing/news/2158229/phishing-attacks-against
64. Titus, D. and Roy, S. (2005). Phishing on the Net, http://www.asialaw.com/default.asp?page=14&ISS=16853&SID=518004
65. Vusumuzi Ka Nzapheza (2007). Number of 'phishing' victims jumps 20%, 08 March 2007 at 05h00,
    http://www.ioltechnology.co.za/article_page.php?iSectionId=2885 & iArticleId=3720753, (Accessed on 07.04.07).
66. Young, T. (2007). Online fraud losses increase 55 per cent, 07 November, http://www.computing.co.uk/computing/news/2168086/apacs-figures-show-rise-online.
67. Zoheb, Hossain (2007). Hook, line and sinker- Beware of phishing, www.indlaw.com/publicdata/articles/article218.pdf
68. Zvomuya, P. (2007). How to combat bank fraud, http://www.mg.co.za/personalfinance/ articlePage.aspx? articleid=297928&area=/personal_finance/pers_fin_banking/