Originally, phishing was identified as the use of electronic mail messages, designed to look like messages from a trusted agent, such as a bank, auction site, or online commerce site. These messages usually implore the user to take some form of action, such as validating their account information. These messages often use a sense of urgency (such as the threat of account suspension) to motivate the user to take action. Recently, there have been several new social engineering approaches to deceive unsuspecting users. These include the offer to fill out a survey for an online banking site with a monetary reward if the user includes account information, and email messages claiming to be from hotel reward clubs, asking users to verify credit card information that a customer may store on the legitimate site for reservation purposes. Included in the message is a URL for the victim to use, which then directs the user to a site to enter their personal information. This site is crafted to closely mimic the look and feel of the legitimate site. The information is then collected and used by the criminals. Over time, these fake emails and web sites have evolved to become more technically deceiving to casual investigation.

Recently the definition of phishing has grown to encompass a wider variety of electronic financial crimes. In addition to the widespread use of these fake email messages and web sites to lure users into divulging their personal information, we have also observed an increase in the amount of malicious code that specifically targets user account information. Once installed on a victim’s computer, these programs use a variety of techniques to spy on communications with web sites and collect account information. This method differs from the technical subterfuge generally associated with phishing scams and can be included within the definition of spyware as well. It is important to include them in a discussion on phishing trends for the following reasons:

Social component – Criminals often use social engineering along with vulnerabilities in applications such as web browsers or email clients to trick users into installing malicious code on their computer.

Common infrastructure – We have observed the use of common tools and techniques for delivering phishing emails and distributing malware. These include the use of botnets, open mail relays, and compromised web sites to host phishing sites and malware.

The big picture - As countermeasures are implemented to thwart one method of stealing information, criminals still have additional opportunities available to them. It is important to understand the technical capabilities available to these criminals so that more effective measures for protecting customer information can be developed and law enforcement personnel tasked with tracking down and prosecuting criminals conducting phishing scams can be more effective.