4. Create a response plan now. Before you become a target, establish a cross-functional antiphishing team and develop a response plan so that you're ready to deal with any attacks. Ideally, the team should include representatives from IT, communications, PR, marketing, Web, customer service and legal services. "If you wait until an attack hits you, it's definitely too late," advises APACS's Salmond.
First, hammer out how you'll inform customers of an attack. Post news of new phishing e-mails targeting your company on your Web site, reiterating that they are not from you and that you didn't - and wouldn't - ask for such information. "If your company is hit, the information should already be on your Web site, instead of responding two days later," says the FTC's Poss. If it's your first attack, you might also want to alert customers via e-mail.
Employees at all customer contact points need to know what to say and do if a customer reports a new phishing attack. Salmond recommends developing appropriate scripts for each customer contact point. If you do detect fraud, you need to have a codified process to follow to alert affected customers and give them new account numbers and passwords.
A good response plan should also outline whom to contact at the various ISPs to get a phisher site shut down as quickly as possible. Identifying law enforcement contacts ahead of time will give you a better chance of bringing the perpetrator to justice.
Now that EarthLink has formalized procedures with other ISPs, it can usually shut down a US-based phisher site within two days, down from the seven days it took in April 2003. Overseas sites are a different matter; those tend to take 20 to 22 days to shutter. The FBI's Curran recommends using software tools to capture links on the phisher Web site before it's shut down; this will let law enforcement recreate the phisher site forensically to determine how the victims' info was captured and where it was sent.
5. Proactively monitor for phishers and fraud. Phishers usually set up the fake sites that will collect responses about eight days before sending out phishing e-mails. So one way to stop them from swindling your customers is to find and shut down these "landing" sites before they launch their e-mail campaigns. You can outsource the search for phishing sites to a fraud alert service. Such services use technologies that crawl the Web looking for unauthorized uses of your logo or newly registered domains that contain your company's name, either of which might be an indication of an impending phishing attack. Some fraud alert services also take aggressive actions to counter attacks, such as launching something akin to a denial-of-service attack that keeps phishers' servers busy so that they can't accept customer information.
MasterCard recently announced a partnership with NameProtect, a fraud detection and alert service. If NameProtect detects suspicious activity, MasterCard alerts law enforcement and the banks that issue its cards. The service also keeps tabs on black-market Web sites where fraudsters often try to sell stolen account information (known as phish). If anyone tries to sell MasterCard accounts, NameProtect notifies MasterCard, which in turn tells the issuing banks so that they can protect themselves and their cardholders from having card accounts compromised. Although MasterCard has such a well-developed list of contacts in the ISP community that it can usually shut down a phisher site within two days, sometimes it allows phisher sites to stay up long enough to capture the evidence needed to prosecute the phishers. "We get all the information being lured into the site so we can provide it to the financial institutions so they can block the [affected] accounts," says Sergio Pinon, senior vice president of security and risk services at MasterCard.
Existing fraud detection systems can be fine-tuned to pick up on a phishing fraud, by making them more sensitive to address changes, new account applications and out-of-character transactions. PayPal's Miller says his company's fraud and spoof detection systems run around the clock. If a PayPal member who typically makes an eBay purchase of around $40 every few months suddenly appears to be making a $4000 purchase, PayPal can pick up on that unusual activity within an hour. "We might call and say: 'Did you make this purchase? Are you really buying a plasma TV?' If not, it's very easy for us to contact the merchant and say: 'Don't ship the item, it's not authorized by the buyer'," says Miller. PayPal would then set in motion a process that includes giving the PayPal member a new account number and having her choose a new password. It would also kick off an investigation to collect information on the incident to pass along to law enforcement agents.
Such vigilance is slowly starting to pay off in court. In February, Alec Scott Papierniak, a Minnesota scammer who phished PayPal members, pleaded guilty to wire fraud in US federal court. In May, Zachary Keith Hill of Houston was sentenced to almost four years in prison for defrauding consumers of personal financial information in phishing schemes that spoofed AOL and PayPal.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.