Gartner: Phishing on the rise

Watch out! Phishing attacks in the United States increased dramatically this past year, costing consumers more than $3 billion in 2007, and there is no end in sight, according to a recent survey by Gartner. Phishing is one of the latest weapons being used by hackers to crawl into a database, distort it and steal valuable data. The Gartner survey found that 3.6 million adults lost money in phishing attacks in the 12 months ending in August 2007, compared to 2.3 million adults the previous year.

"Phishing attacks are becoming more surreptitious and are often designed to drop malware that steals user credentials and sensitive information from consumer desktops," Avivah Litan, vice president and analyst at Gartner, told Tekrati. "Anti-phishing detection and prevention solutions are available but not utilized widely enough to stop the damage. These must be deployed and combined with solutions that also proactively detect and stop malware-based attacks."

At the top of the phishing target list are, of course, PayPal and eBay, but it's too soon for any CIO to breathe a sigh of relief. Phishing attackers are using all kinds of devious methods such as electronic greeting cards, charities and foreign businesses to lure computer users into letting the hacker in. The survey found that 47 percent of those who lost money had unauthorized charges made on their debit or check card in 2007. Thieves may be targeting debit cards and bank accounts because back-end fraud detection systems are traditionally weaker than credit card accounts, according to Litan.

"Regulators must get a better handle on the problem through consistent and timely bank reporting on their fraud incidents and losses," Litan said. Gartner expects phishing and malware attacks to grow in the year ahead because it's a lucrative business. And the consulting company sees no easy way to thwart these attacks unless e-mail providers spend the money on solutions that can keep phishing out. "Enterprises should at least protect their own brands from being used in phishing attacks by subscribing to an anti-phishing solution," Litan said. So the big question for CIOs is this: Are you there yet, and what would it take to make your company phish-proof?

For more on phishing dangers:
- See this Tekrati Article