Anti-Phishing Working Group
Phishing Attack Trends ReportFebruary, 2004

Phishing attacks involve the mass distribution of 'spoofed' e-mail messages with return addresses, links, and branding
which appear to come from banks, insurance agencies, retailers or credit card companies. These fraudulent messages
are designed to fool the recipients into divulging personal authentication data such as account usernames andpasswords, credit card numbers, social security numbers, ATM card PINs, etc. Because these emails look “official” andrecipients trust the brand, they often respond to them, resulting in financial losses, identity theft, and other fraudulentactivity.
The Phishing Attack Trends Report analyzes phishing attacks reported to the Anti-Phishing Working Group via theorganization’s website, http://www.antiphishing.org or email submission via reportphishing@antiphishing.org. The AntiPhishing Working Group phishing attack repository is the Internet’s most comprehensive archive of email fraud andphishing attacks.

Highlights••••

Number of unique phishing attacks reported in February:
Average number of unique phishing attacks per day reported in February:
Organization most targeted by phishing attacks in February:Business sector most targeted by phishing attacks in February:

282
9.7
eBay
Financial Services

The Phishing Attack Trends Report is published monthly by the Anti-Phishing Working Group, an industry
association focused on eliminating the identity theft and fraud that result from the growing problem of phishing andemail spoofing. For further information, please contact Dan Maier at dmaier@antiphishing.org or +1 650-216-2078.
Analysis for the Phishing Attack Trends Report has been donated by the Tumbleweed Communications Message
Protection Lab. The mission of the Tumbleweed Message Protection Lab is to analyze enterprise email threats (e.g.
spam, email fraud, viruses, etc) and design new email protection technologies.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Anti-Phishing Working Group
Email Phishing Attack Trends
In February, there were 282 new, unique phishing attacks reported to the Anti-Phishing Working Group. This
was a 60% increase over the number of attacks reported in January (176). The average number of phishingattacks per day grew significantly in February to 9.7. Analyzing this information on a weekly basis shows anincreasing trend, with a peak of 12.4 attacks per day in the third week of February.

Who Is Being Targeted?
Most-Targeted Companies
The most targeted companies in February werelargely similar to those targeted in previousmonths. eBay once again was the most targetedcompany, with 104 unique attacks that hijacked
eBay’s brand. This represents over 100%
growth in attacks from the number seen in
December (51). Citibank was once again thesecond most attacked company in February with58 unique attacks hijacking its brand, a 66%growth in attacks. And displacing AOL as thethird most-phished company was Paypal with 42attacks (320% growth). Other notable attack
increases seen February were seen by Fleet
Bank, Visa, and Barclays. And interestingly,
there were NO reported phishing attacks against
American Express in February.
Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Anti-Phishing Working Group
Most-Targeted Industry Sectors
The most targeted industry sector for phishing attacks continues to be Financial Services, from theperspective of total attacks as well as number of companies targeted. The Retail sector (primarily onlineretailers) continues to follow closely after, although there are fewer retailers targeted. The FinancialServices sector averaged 14.6 phishing attacks reported per company in February, while the Retail sector
averaged 27.8 reported attacks (driven largely by one targeted company – eBay).

Over the past three months, it appears thatphishers are starting to focus on attacking asmaller set of target companies with a larger
volume of phishing attacks. The chart at rightshows the number of companies targeted ineach industry sector over time, and each sector
shows a trend that fewer companies are being
targeted each month.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org

Anti-Phishing Working Group

About the Anti-Phishing Working GroupThe Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft andfraud that result from the growing problem of phishing and email spoofing. The organization provides a forum todiscuss phishing issues, define the scope of the phishing problem in terms of hard and soft costs, and share
information and best practices for eliminating the problem. Where appropriate, the APWG will also look to share
this information with law enforcement.
Membership is open to qualified financial institutions, online retailers, ISPs, the law enforcement community, andsolutions providers. Note that because phishing attacks and email fraud are sensitive subjects for manyorganizations that do business online, the APWG has a policy of maintaining the confidentiality of member
organizations.
The Web site of the Anti-Phishing Working Group is http://www.antiphishing.org. It serves as a public and industry
resource for information about the problem of phishing and email fraud, including identification and promotion ofpragmatic technical solutions that can provide immediate protection and benefits against phishing attacks. Theanalysis, forensics, and archival of phishing attacks to the Web site are currently powered by Tumbleweed
Communications' Message Protection Lab.
The APWG was founded by Tumbleweed Communications and a number of member banks, financial services
institutions, and e-commerce providers. It held its first meeting in November 2003 in San Francisco.

Anti-Phishing Working Group
http://www.antiphishing.org ● info@antiphishing.org