# Presentation: 349877

## Computer Fraud – “Phishing”

- Identity Theft in
- Financial Services

- 6/30/04

## “...The use of digital media also can lend fraudulent material an air of credibility. Someone with a home computer and knowledge of computer graphics can create an attractive, professional-looking Web site, rivaling that of a Fortune 500 company...”

*Arthur Levitt*
*Former Chairman of the SEC*

- Quotes

## Quotes

- “...The Internet is a perfect medium to locate victims and provide an environment where victims do not see or speak to the “fraudsters”.  Anyone in the privacy of their own home can create a very persuasive vehicle for fraud over the Internet...”
-  *Louis J. Freeh*
* **Former FBI Director*

## Session Objectives

- Raise awareness of threats & risks of phishing
- Outline process to reduce the impact of phishing
*This is *_*not*_* a technical session.*

## Session Outline

- Phishing 101
- Risks
- Trends
- Examples
- Action Plan Ideas
- Responses & Resource Examples
- Summary

## Phishing 101

**Internet**
- Connectivity
- Access
- Anonymity
- Velocity
- Software vulnerabilities

## Phishing 101

- Phishing uses e-mail to lure recipients to bogus websites designed to fool them into divulging personal data.

## Phishing 101

**E-mail**
- Spoofed address
- Convincing
- Sense of urgency
- Embedded link (but not always)

## Phishing 101

**Website**
- Spoofed/similar address
- Spoofed look/feel
- Authentication screen/pop-up window
- Possible redirect to actual website

## Phishing 101

**Scam relies on:**
- Unrecognized spam
- % w/ existing relationship
- Ease of registering a website
- Social engineering

## Risks

_**Consumer**_
**ID Theft**
- Open new accounts
**Fraud**
- Unauthorized credit card transactions
- A/C withdrawals

## Risks

_**Organization Impersonated**_
**Reputation Risk**
- Impression of weak security
- Impression of ignorance
- Inadequate education program
- Inadequate response program
- Negative publicity
**Strategic Risk**
- Impact to on-line strategy (i.e. adoption/retention rates)

## Risks

_**Organization Impersonated**_
**Transaction Risk**
- Fraudulent transactions
**Legal Risk**
- Possible litigation
**Operational Risk**
- Added cost to respond/assist consumers

## Trends

_**Anti-Phishing Working Group**_**The Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft and fraud that result from the growing problem of phishing and email spoofing. **_**APWG Members**_**- Over 400 members****- Over 250 companies****- 8 of the top 10 US banks****- 4 of the top 5 US ISPs****- Over 100 technology vendors****- Law enforcement from Australia, CA, UK, USA**_** **_

## Trends

- Source: Anti-Phishing Working Group Phishing Attach Trends Report s- March 2004 & May 2004

## Trends

## Examples (June 2004)

## Examples (June 2004)

## Examples (June 2004)

## Examples (March 2004)

- Source: Anti-Phishing Working Group Phishing Archive

## Examples (March 2004)

- Source: Anti-Phishing Working Group Phishing Archive

## Examples (March 2004)

- Source: Anti-Phishing Working Group Phishing Archive

## Examples (May 2004)

- Source: Anti-Phishing Working Group Phishing Archive

## Examples (May 2004)

- Source: Anti-Phishing Working Group Phishing Archive

## Examples (May 2004)

|  |
| --- |
|                                                                             |
|   |

- Source: Anti-Phishing Working Group Phishing Archive

## Examples (May 2004)

- Source: Anti-Phishing Working Group Phishing Archive

## Examples (May 2004)

- Source: Anti-Phishing Working Group Phishing Archive

## Examples (May 2004)

- Source: Anti-Phishing Working Group Phishing Archive

## Examples (FYI)

- Internet Explorer browser exploit allows the URL in the web browser to be “masked”.
- Users would not know by looking at the browser window that they were at a different site than indicated.
- Patch issued (how many users installed?)

## Related Examples (July ‘03)

- Twist – newspaper vs. e-mail
- CU official thought suspicious (service area)
- Site _[www.centurycredit.org](http://www.centurycredit.org/)__ mirrored __[www.centurycu.org](http://www.centurycu.org/)__ (NCUA logo too)_
- Collected personal info. & loan app fees
- Toll free #
- Site shut down (GA), but ads persist

## Education
Protect on-line identity of FI
Response Plan

- Protect on-line identity of FI
- Response Plan

- Action Plan Ideas

## Self
Review resource sources*
Institution
Training / Policy Development
Awareness
Handling complaints & reports of suspicious e-mails/sites 
Protect on-line identity of FI*
Response Plan*

- Review resource sources*
_**Institution**_
- Training / Policy Development
- Awareness
- Handling complaints & reports of suspicious e-mails/sites
- Protect on-line identity of FI*
- Response Plan*

- Action Plan Ideas - Education

** More info. on other slides*

## Member / Customer
Communication Methods
Internet Banking Agreements
Newsletters 
Statement Stuffers 
Recordings when on “hold”
Website 
Messages / FAQs / Advisories / Links to outside resources/ Current Fraud link

- Communication Methods
- Internet Banking Agreements
- Newsletters
- Statement Stuffers
- Recordings when on “hold”
- Website
- Messages / FAQs / Advisories / Links to outside resources/ Current Fraud link

- Action Plan Ideas - Education

## Action Plan Ideas - Education

## Action Plan Ideas - Education

## Action Plan Ideas - Education

## Action Plan Ideas - Education

## Member / Customer
Content
We will never ask for xxx via e-mail
We will never alert you of xxx via e-mail
Always feel free to call us at # on statement
Always type in our site URL (see statement / newsletter / previous bookmark)

- Content
- We will never ask for xxx via e-mail
- We will never alert you of xxx via e-mail
- Always feel free to call us at # on statement
- Always type in our site URL (see statement / newsletter / previous bookmark)

- Action Plan Ideas - Education

## Member / Customer
Content (cont’d)
Sites can be convincingly copied
Report suspicious e-mails & sites 
Where to get more advice on phishing
Importance of patching
How to validate site (via cert or seal)
Where to go for ID theft help

- Content (cont’d)
- Sites can be convincingly copied
- Report suspicious e-mails & sites
- Where to get more advice on phishing
- Importance of patching
- How to validate site (via cert or seal)
- Where to go for ID theft help

- Action Plan Ideas - Education

## 
Considerations
Review related regulatory issuances, such as:
NCUA LTR 02-CU-16 Protection of CU Internet Addresses* 
FFIEC Information Security Booklet*

		*See IS&T portion of NCUA’s website

_**Considerations**_
- Review related regulatory issuances, such as:
- NCUA LTR 02-CU-16 Protection of CU Internet Addresses*
- FFIEC Information Security Booklet*
***	******	*************See IS&T portion of NCUA’s website***

- Action Plan Ideas – Protection of FI’s Online Identity

## Considerations (cont’d)
Keep certificates up-to-date
Practice good domain name controls
Don’t let URLs lapse
Purchase similar URLs
Search for similar URLs

- Keep certificates up-to-date
- Practice good domain name controls
- Don’t let URLs lapse
- Purchase similar URLs
- Search for similar URLs

- Action Plan Ideas – Protection of FI’s Online Identity

## Notification Considerations
Attorney
Law Enforcement
Bonding Co.
Regulator(s)
Domain host / owner / registrar
Members / Customers

- Attorney
- Law Enforcement
- Bonding Co.
- Regulator(s)
- Domain host / owner / registrar
- Members / Customers

- Action Plan Ideas - Response

## Notification Considerations (cont’d)
Press
Suspicious Activity Report
Internet Fraud Compliant Center
FTC
Industry Fraud Associations / Groups

- Press
- Suspicious Activity Report
- Internet Fraud Compliant Center
- FTC
- Industry Fraud Associations / Groups

- Action Plan Ideas - Response

## NCUA (www.ncua.gov)

Specific guidance:

(8/03) LTR 03-CU-12 Fraudulent Newspaper Advertisements, and Websites by Entities Claiming to be Credit Unions

(04/04) LTR 04-CU-05 Fraudulent E-Mail Schemes

(05/04) LTR 04-CU-06 E-Mail & Internet Related Fraudulent Schemes Guidance

- Specific guidance:
- (8/03) LTR 03-CU-12 Fraudulent Newspaper Advertisements, and Websites by Entities Claiming to be Credit Unions
- (04/04) LTR 04-CU-05 Fraudulent E-Mail Schemes
- (05/04) LTR 04-CU-06 E-Mail & Internet Related Fraudulent Schemes Guidance

- Responses & Resource Examples

## NCUA (www.ncua.gov)

Related guidance:
(12/02) LTR 02-CU-16 Protection of CU Internet Addresses
(7/02) LTR 02-FCU-11 Tips to Safely Conduct Financial Transactions Over the Internet
(09/01) LTR 01-CU-09 Identity Theft & Pretext Calling

Working with FBI, FFIEC, SSAs, Newspaper Association

Article in NCUA News

- Related guidance:
- (12/02) LTR 02-CU-16 Protection of CU Internet Addresses
- (7/02) LTR 02-FCU-11 Tips to Safely Conduct Financial Transactions Over the Internet
- (09/01) LTR 01-CU-09 Identity Theft & Pretext Calling
- Working with FBI, FFIEC, SSAs, Newspaper Association
- Article in NCUA News

- Responses & Resource Examples

## FDIC (www.fdic.gov)

(03/04) FIL-27-2004 Guidance on Safeguarding Customers Against E-mail & Internet-Related Fraudulent Schemes

OTS (www.ots.gov)

(03/04) Memo – Phishing & E-mail Scams

- (03/04) FIL-27-2004 Guidance on Safeguarding Customers Against E-mail & Internet-Related Fraudulent Schemes
_**OTS **__**(www.ots.gov)**_
- (03/04) Memo – Phishing & E-mail Scams

- Responses & Resource Examples

## OCC (www.occ.gov)

(09/03) Alert – Customer Identity Theft: E-mail-Related Fraud Threats

FI Trade Associations

Most have issued guidance to FIs and consumers
FI Industry Consortium
Subcommittee addressing issue

- (09/03) Alert – Customer Identity Theft: E-mail-Related Fraud Threats
_**FI Trade Associations**_
- Most have issued guidance to FIs and consumers
_**FI Industry Consortium**_
- Subcommittee addressing issue

- Responses & Resource Examples

## FFIEC (www.ffiec.gov)
Information Security Booklet

FTC (www.ftc.gov)

(7/03) How Not to Get Hooked by the “Phishing” Scam

(9/02) ID Theft: When Bad Things Happen to Your Good Name

Can report incidents

- Information Security Booklet
_**FTC **__**(www.ftc.gov)**_
- (7/03) How Not to Get Hooked by the “Phishing” Scam
- (9/02) ID Theft: When Bad Things Happen to Your Good Name
- Can report incidents

- Responses & Resource Examples

## Treasury (www.treas.gov)

(1/04) Statement Warning about Recent Fraudulent E-mail Scams

Dept. of Justice (www.usdoj.gov & www.cybercrime.gov)

(2004) Special Report on “Phishing”
Also includes links to on-line protection & response notifications from various FIs.

FBI (www.fbi.gov & www.ifccfbi.gov)

(7/03) FBI Says Web “Spoofing” Scams are a Growing Problem
Also see Internet Fraud Complaint Center (IFCCBI) for info on reporting incidents

- (1/04) Statement Warning about Recent Fraudulent E-mail Scams
_**Dept. of Justice **__**(www.usdoj.gov & www.cybercrime.gov)**_
- (2004) Special Report on “Phishing”
- Also includes links to on-line protection & response notifications from various FIs.
_**FBI **__**(www.fbi.gov & www.ifccfbi.gov)**_
- (7/03) FBI Says Web “Spoofing” Scams are a Growing Problem
- Also see Internet Fraud Complaint Center (IFCCBI) for info on reporting incidents

- Responses & Resource Examples

## Better Business Bureau (www.bbb.org/phishing)

Issuing media alerts through its national and local offices.
www.callforaction.org

International, non-profit network of consumer hotlines and information.  Worked with Visa to develop much of its material on ID theft.

- Issuing media alerts through its national and local offices.
_**www.callforaction.org**_
- International, non-profit network of consumer hotlines and information.  Worked with Visa to develop much of its material on ID theft.

- Responses & Resource Examples

## Anti-Phishing Working Group
(www.antiphising.org)

Industry association w/comprehensive resources (i.e. phishing archive, reporting, consumer guidance, resource links/papers, special reports, links to FIs/other orgs with anti-phishing consumer guidance on their websites, etc.)

Information Technology Association of America (www.itaa.org)

Coalition (includes to MS, Amazon, eBay) to curb ID theft

_**(www.antiphising.org)**_
- Industry association w/comprehensive resources (i.e. phishing archive, reporting, consumer guidance, resource links/papers, special reports, links to FIs/other orgs with anti-phishing consumer guidance on their websites, etc.)
_**Information Technology Association of America **__**(www.itaa.org)**_
- Coalition (includes to MS, Amazon, eBay) to curb ID theft

- Responses & Resource Examples

## Trusted Electronic Communications Forum
(www.tecf.org)

New standards and research effort to focus on establishing new standards for protecting consumers and teach end users how to better protect themselves. 
Several well-known financial services organizations represented.

_**(www.tecf.org)**_
- New standards and research effort to focus on establishing new standards for protecting consumers and teach end users how to better protect themselves.
- Several well-known financial services organizations represented.

- Responses & Resource Examples

## Spam, social engineering, urgency
Increasing # of events
FIs targeted
Variations appearing
Risk to FIs and consumers
Proactive action needed

- Increasing # of events
- FIs targeted
- Variations appearing
- Risk to FIs and consumers
- Proactive action needed

- Summary

## Quotes

- “Bogus e-mails that try to trick customers into giving out personal information are the hottest, and most troubling, new scam on the Internet.”
* **Jana Monroe*
* **Assistant Director*
*Cyber Division of FBI*