Talk:Phishing/Archive 1

message: Be aware of how it works.
Here’s what to look for:
* An email is sent that looks like it came from a site you do business with.
* The email requests that you provide or confirm personal information, login credentials or account numbers.
Here’s what you should do:
* Never send personal info, your password or account numbers in an email.
* When clicking on a link, be sure you end up on a secure site.
I thought it would be appropriate to structure the above into the main body of the discussion page. I hope this doesn't upset anyone.TheGrandMaster1 12:27, 25 September 2006 (UTC)
thread_title:  Be aware of how it works. 

message: I'm starting to think that this is a linking board.  Does anyone else think this page has too many external links? --ZeWrestler  Talk 00:22, 28 July 2005 (UTC)
thread_title:  Too many external links 

message: Content literally lifted without attribution on a link farm site: http://www.fraudwatchernetwork.com/website/phishing.html
JavaWoman 04:17, 2 August 2005 (UTC)
thread_title:  Copyleft violation 

message: I am wondering if we really need all three phishing examples?  The last two are, as you say, practically the same so that maybe just keeping the 3rd example would be sufficient between those two (esp since the text with this one is more informative).  It just seems like they take up so much room as it stands now.  Maybe they could be made smaller also/instead? --Exmachina 16:44, 3 August 2005 (UTC)
thread_title:  Examples Section 

message: The following is an part of the convo from Wikipedia:Featured article candidates/Phishing/archive1.
+++++++++++++
*Not sure if the User-Friendly FAQ entry helps much, though--it appears to allow non-commercial use only, which violates the GFDL. Might want to either justify fair use or yank the strip (it doesn't seem essential to the article, esp. considering the large number of other excellent illustrations). Best wishes, Meelar (talk) 15:58, August 24, 2005 (UTC)
**The user friendly copytag is not listed under GFDL.  It is listed under Free licenses. GFDL does not apply to this image.  Copyright for the image applys to this site, because the image is being used for educational purposes, as specified on the FAQ above.  If the image becomes too much of an issue, i'll remove it from the article, but personally, I would preferr to keep it in. I believe it adds a nice touch to the article. --ZeWrestler  Talk 17:07, 24 August 2005 (UTC)
replies: text: Please be aware that as a  image uploaded after May 19, 2005, the image may be deleted at any time. --Tabor 23:33, 31 October 2005 (UTC)
thread_title:  Userfriendly image (stay or go) 

message: Look out for this IP, 68.193.245.80 - it appears to be Joseph Steinberg, who has been pushing his GreenArmor solution, and placing sites which link to his URLs in the links section of phishing and pharming. The sites often rehash old Wikipedia content, such as his own site at phishing-pharming.com (registered to him).
Joseph - you're quite welcome to edit the content, but this isn't your personal advertising board.
Oh, and I've had fun making changes to this article - my first big series of edits - and I hope you all can work with them to improve the article further. -82.33.52.78 13:26, 28 August 2005 (UTC)
thread_title:  Changes by 68.193.245.80 

message: CNN Article about phishing]
Hurricane Katrina has really generated a lot of phishing scams.  Thought i'd share it with people here. --ZeWrestler  Talk 16:16, 9 September 2005 (UTC)
thread_title:  Katrina Phishing 

message: Should something be done about the example image? I don't know if identifying a particular bank is a good idea...
Maybe the image should be degraded with a visible "EXAMPLE" watermark to prevent trivial re-transmission by wannabe phishers. It's one thing to give a low-quality example, but to provide the original image verbatim might be a bit questionable.
--203.45.114.193 00:32, 23 October 2005 (UTC)
thread_title:  Phishing example 

message: I just got sent this email.. Anyone whos seen the example on the main page would recognize the style of it
Feel free to add this as an example in relation to this topic
Take notice to the fact that the email address is from: service@bankofmerica.com 
The URL is fake as well. It takes you to: http://www.___.de/templates/update/update.htm
Which is a template based off the BOA style sheet and asks you to fill in all your relevant banking information
Including your pin and all your personal information.
If u take all the folders off the url and go to the root at: http://www.___.de/ 
It takes you to deutch forum page.
I have notified BOA about this issue and they are looking into it now
But beware of things like this.
Sincerely, 
William Hamilton
aka o0paradox0o
I removed those for URL, since this was settled complete meanwhile. I had a quantity annoyance therefore. Obviously my ftp account for these actions was abused. 129.35.231.16 11:36, 19 January 2006 (UTC)
replies: text: This discussion was originally at WP:FAC, but was then moved to WP:FAR and has now been moved here because the issue, the lack of an image, has been solved thanks to User:Andrew Levine.
A tough article to find an appropriate picture for, but it's been requested for the main page. →Raul654 02:17, 31 October 2005 (UTC)

text: I uploaded :Image:Phish.jpg, but I'm not sure if it's quite the right thing (I prefer that images don't have significant text in them). I've seen a few illustrations with something simple like a fish hook with large @ glyph dangling from it. If someone with image composition skills feels motivated, perhaps a free version of such an image could be created. --Tabor 23:12, 31 October 2005 (UTC)
replies: text: BTW, how did it get to FA status with an image using the deprecated  license? --Tabor 23:25, 31 October 2005 (UTC)

text: I like :Image:Phish.jpg; the text isn't too important to the image and it still gets the point across at thumbnail size.  Creating our own flashy image rather than using one from a real anti-phishing government public information campaign might just be a little hokey and unencyclopedic.--Pharos 23:01, 5 November 2005 (UTC)
replies: text: I personally don't think that an image created by some of our editors would be unencyclopedic.  Depending on whats created, i think something better could be created by one of our own editors. I've put in 2 requests with some members of WikiProject Illustration to see if they'll create anything. --ZeWrestler  Talk 15:56, 7 November 2005 (UTC)
thread_title:  BANK OF AMERICA SCAM 

message: :This discussion was originally at WP:FAC, but was then moved to WP:FAR and has now been moved here because the issue, the lack of an image, has been solved thanks to User:Andrew Levine.
A tough article to find an appropriate picture for, but it's been requested for the main page. →Raul654 02:17, 31 October 2005 (UTC)
replies: text: I uploaded :Image:Phish.jpg, but I'm not sure if it's quite the right thing (I prefer that images don't have significant text in them). I've seen a few illustrations with something simple like a fish hook with large @ glyph dangling from it. If someone with image composition skills feels motivated, perhaps a free version of such an image could be created. --Tabor 23:12, 31 October 2005 (UTC)
replies: text: BTW, how did it get to FA status with an image using the deprecated  license? --Tabor 23:25, 31 October 2005 (UTC)

text: I like :Image:Phish.jpg; the text isn't too important to the image and it still gets the point across at thumbnail size.  Creating our own flashy image rather than using one from a real anti-phishing government public information campaign might just be a little hokey and unencyclopedic.--Pharos 23:01, 5 November 2005 (UTC)
replies: text: I personally don't think that an image created by some of our editors would be unencyclopedic.  Depending on whats created, i think something better could be created by one of our own editors. I've put in 2 requests with some members of WikiProject Illustration to see if they'll create anything. --ZeWrestler  Talk 15:56, 7 November 2005 (UTC)
thread_title: Image talk

message: I remember reading in PC Answers once that at one time the most common form of Internet fraud consisted of bogus pornographic websites which asked for credit card details, supposedly as proof of age.  Does anyone here know more about this? GCarty 15:40, 13 December 2005 (UTC)
thread_title:  Fake porn sites 

message: ===One-time password phishing===
the following was taken out of the article. Rather than lose it to the archeives, i've put it here.  For a debate weather it should be used or not. 
The Register [reported in October 2005] about a new type of phishing directed against one-time passwords. F-Secure explains that the online banking customers were given a scratch sheet, which contains a certain number of hidden passwords. As customers use the service they uncover the next password in the list, which gives them access to their account. The phishing website would always complain about the scratch code, thus adding more scratch codes to the criminals records.
--ZeWrestler  Talk 15:19, 20 December 2005 (UTC)
thread_title:  One time -password phishing 

message: the following was taken out of the article. Rather than lose it to the archeives, i've put it here.  For a debate weather it should be used or not. 
The Register [reported in October 2005] about a new type of phishing directed against one-time passwords. F-Secure explains that the online banking customers were given a scratch sheet, which contains a certain number of hidden passwords. As customers use the service they uncover the next password in the list, which gives them access to their account. The phishing website would always complain about the scratch code, thus adding more scratch codes to the criminals records.
--ZeWrestler  Talk 15:19, 20 December 2005 (UTC)
thread_title: [[One-time password]] phishing

message: "In a June 2004 experiment with spear phishing, 80% of 500 West Point cadets who were sent a fake email were tricked into revealing personal information."
Perhaps it should be noted that the experiment tested a population specifically trained to follow orders without question, and that the result might therefore be artificially high.--—Preceding unsigned comment added by MBlume (talk • contribs) 
:If that's true, then I could send them an e-mail saying "Hello, I'm some guy who you've never heard of. Send me all your money because I say so." I'll be filthy rich in a matter of weeks! JIP | Talk 10:00, 26 April 2006 (UTC)
thread_title:  West Point 

message: Not all phising involes money scams some are just to get an account on a recreational site such as myspace to mess around with the profile, prephaps that should be added into the article? —Preceding unsigned comment added by 68.45.92.85 (talk • contribs) 23:14 2 May 2006 (UTC)
: I think that's a good idea. For example, check out rnyspacelogin.com, against whom Myspace has filed suit in federal court. http://dockets.justia.com/docket/court-vaedce/case_no-1:2006cv00544/case_id-204442/ This appears to be for advertising purposes, from what I've gathered - take over profiles and spam comments/bulletins. (Sorry, I forgot to sign the comment - Orpheus42 05:44, 7 September 2007 (UTC)
thread_title:  Phishing for fun? 

message: I assume "national prominence" refers to the United States (the article on Phish states that they were an American band)? I clarified the text accordingly. Mtford 10:48, 8 June 2006 (UTC)
thread_title:  National prominence of Phish band 

message: I just received yet another eBay phishing mail. What was interesting was that the URL actually used FTP instead of HTTP, and included the username and password. So I went to the site with a dedicated FTP client, entered the username and password, received the HTML, modified it, and put it back. Now people who get the same phishing mail will see "This is a phishing site! Do not enter any information to this site or the phisher will steal your credit card!" when they click on the link. I don't know how long it will stay that way, if the phisher finds this out. This is the first time I've actually had proper revenge on a phisher. JIP | Talk 16:14, 4 July 2006 (UTC)
thread_title:  I got revenge on a phisher! 

message: I'd agree that it isn't necessary, but it was a response to a  tag. Rather than remove the tag without a reference to add, I added a reference. If you all think the reference isn't needed, you can take it out. Moncrief 22:24, 16 August 2006 (UTC)
thread_title:  Added reference 

message: The use of cracker in place of phisher is incorrect. Cracker is commonly used to describe a person who maliciously hacks into secure directories where a phisher "fishes" for vulnerable users to reply to a phishing scam.I already forgot 08:22, 21 August 2006 (UTC)
thread_title:  cracker vs. phisher 

message: I would like to ask a section for reporting phish be added under the Anti-Phishing heading.  Many people don't know what to do with phishing emails, and as a result they are deleted and the phisher continues on.  I did not make the addition myself because I'm associated with PIRTand I believe it should be included in the new section along with several other institutions.  I am not sure what the rules are around making such additions, I don't want it to be viewed as spam so I thought I would bring it up here.  In a nutshell, PIRT stands for "Phishing Incident Reporting and Termination".  We started up about 5 1/2 months ago.  The service is 100% free to the public, the brands and the companies getting our feed.  We are staffed by volunteers from around the world who dedicate their time to taking down phish.  RLaudanski 18:25, 26 August 2006 (UTC)
thread_title:  Addition Request 

message: I removed:
----
The FTC suggests these tips to help you avoid getting hooked by a phishing scam:
If you get an email or pop-up message that asks for personal or financial information, do not reply. And don’t click on the link in the message, either. Legitimate companies don’t ask for this information via email. If you are concerned about your account, contact the organization mentioned in the email using a telephone number you know to be genuine, or open a new Internet browser session and type in the company’s correct Web address yourself. In any case, don’t cut and paste the link from the message into your Internet browser — phishers can make links look like they go to one place, but that actually send you to a different site.
Use anti-virus software and a firewall, and keep them up to date. Some phishing emails contain software that can harm your computer or track your activities on the Internet without your knowledge.
Anti-virus software and a firewall can protect you from inadvertently accepting such unwanted files. Anti-virus software scans incoming communications for troublesome files. Look for anti-virus software that recognizes current viruses as well as older ones; that can effectively reverse the damage; and that updates automatically.
A firewall helps make you invisible on the Internet and blocks all communications from unauthorized sources. It’s especially important to run a firewall if you have a broadband connection. Operating systems (like Windows or Linux) or browsers (like Internet Explorer or Netscape) also may offer free software “patches” to close holes in the system that hackers or phishers could exploit.
Don’t email personal or financial information. Email is not a secure method of transmitting personal information. If you initiate a transaction and want to provide your personal or financial information through an organization’s website, look for indicators that the site is secure, like a lock icon on the browser’s status bar or a URL for a website that begins “https:” (the “s” stands for “secure”). Unfortunately, no indicator is foolproof; some phishers have forged security icons. 
Review credit card and bank account statements as soon as you receive them to check for unauthorized charges. If your statement is late by more than a couple of days, call your credit card company or bank to confirm your billing address and account balances.
Be cautious about opening any attachment or downloading any files from emails you receive, regardless of who sent them. These files can contain viruses or other software that can weaken your computer’s security.
Forward spam that is phishing for information to spam@uce.gov and to the company, bank, or organization impersonated in the phishing email. Most organizations have information on their websites about where to report problems.
If you believe you’ve been scammed, file your complaint at ftc.gov, and then visit the FTC’s Identity Theft website at www.consumer.gov/idtheft. Victims of phishing can become victims of identity theft. While you can't entirely control whether you will become a victim of identity theft, you can take some steps to minimize your risk. If an identity thief is opening credit accounts in your name, these new accounts are likely to show up on your credit report. You may catch an incident early if you order a free copy of your credit report periodically from any of the three major credit bureaus. See www.annualcreditreport.com for details on ordering a free annual credit report.  http://www.ftc.gov/bcp/conline/pubs/alerts/phishingalrt.htm
----
at the very least it needs massive wikification, and it seems a bit howto. RN 00:39, 4 September 2006 (UTC)
thread_title:  large ftc block 

message: Phishing is a Social Engineering technique, shouldn't it be part of that page? While a comprehensive article is here, the technique still relies on the same cognitive biases of other SE attacks and I don't think it's prevelence makes it any more special. Comments?24.126.126.105 14:51, 20 September 2006 (UTC)
replies: text: No. Without going into detail, I'll address the most obvious one...This is a featured article and has gone through much scrutiny to get to such a status. Had merging been a viable option, it would have been done during the process of making it a featured article. --I already forgot 21:02, 20 September 2006 (UTC)

text: I also believe that Phishing should stay as an article on it's own.  Laymen and kids doing research aren't going to be searching for sicial engineering, they are going to search for the most obvious term.  I think the Social Engineering page should have a brief description of phishing, and then point to this page for details.  I'm also with I already forgot's point that featured and mainstream-referenced pages should not be moved or merged.  I'd also find it strange to remove every article that is a subset of a greater article.  Could you immagine if we'd merge every chemical element into Periodic Table? - NickSentowski 14:40, 21 September 2006 (UTC)
thread_title:  Merge with Social Engineering? 

message: I would like to add the following two-part entry:
"In California, many police departments phish for identities by sending out fake red light camera tickets.  See more info in examples, below."
(And, under Examples:)
"Phishing by the Police
Some phishing comes from where you would least expect it - the officials who are supposed to protect you!  In California, many police departments send out red light camera "tickets" that have not been filed with the Superior Court and thus have no legal weight.   The intent is to bluff the registered owner into revealing the name, address and driver's license number of the person who was driving the car.  Fake ticket examples."
I have seen a comment that the police's activity is not email phishing.  The person making that comment deleted my entry when I made it earlier today.  I note that the title of the overall article is "phishing," not "email phishing."  I note that the article includes discussion of phishing by phone call.  I consulted the Urbandictionary.com, and its definitions of the term include "Scamming method used to ellicit information from "uninformed" computer users through impersonation of trusted sources."  I believe that the police's activity is a good fit, as computers are heavily involved.  While the initial contact is by snail mail, the scheme is furthered when the mailed document instructs the recipient to access a website where he will view the pictures - and can also supply an identity or pay the fine.
Further, since the purpose of Wikipedia is to tell us info that we don't already know, what belongs here more than info about something that is not well known?  (How many of those reading this were previously aware of the scheme?)
:Try Social engineering (security) instead. This is a form of pretexting. --82.33.53.103 19:38, 25 September 2006 (UTC)
replies: text: This is also not your private website to add your POV. Please help to maintain accuracy and NPOV in the article. Thanks. --I already forgot 01:24, 28 September 2006 (UTC)

text: (edit conflict)I'm not the only who has rv the edit. Your edit is POV and is starting to look like linkspam as the link has been added on multiple pages with the exact same text. This is an international article on Phishing, not a platform for a personal problem or POV with local law enforcement. We cannot list every "fishing" attempt by law enforcement in every country so lets stick with internationally and well documented "Phishing". Please read up on WP:NPOV and help contribute instead of pushing your pov.--I already forgot 07:26, 28 September 2006 (UTC)

text: While you wait I ask two things. 1. Please sign your edits on the talk pages. 2. Keep in mind that you (including sockpuppet and website) are the only one in the world that relates "phishing" to controversial police attempts at finding the driver who may have broken the law. Everyone else relates it to website and email scams by criminals. --I already forgot 08:11, 28 September 2006 (UTC)
replies: text: Also, which I mentioned before, you are confusing "fishing" with "phishing". I dont understand how "password harvesting" (the origin of the Ph in PHishing) relates to what you describe but I can see how "fishing" does. Ok, now I feel dumb for getting into this dispute...This is my last reply. --I already forgot 08:32, 28 September 2006 (UTC)
replies: text: I also support not having the content, see Talk:Social engineering (security). Though this talk is good enough reason too. McKay 13:17, 28 September 2006 (UTC)
thread_title:  Add Phishing by Police 

message: I have an example of the type of phishing used sitting in my email inbox. The conmen/women are very clever and everything looks completely legit. If it will benefit readers from seeing an example of a genuine website and a phish website, i'll put up both here - within the discussion section - if you all think it is a good idea. Then you can decide etc. whether it should go on the mainpage etc. But I think, to the uneducated readers, it is worth seeing that there is almost NO different between the legitimate site and the phish site. What do you think?TheGrandMaster1 12:22, 25 September 2006 (UTC)
replies: text: I don't think we need any more examples. Those here already work well, and working on the prose would add a lot more. --82.33.53.103 18:23, 26 September 2006 (UTC)
thread_title:  Examples of Phishing??? 

message: I believe that User:HoodedHound added the image of AOL phishing as a form of self-promotion (he seems to be a phisher). Removing his name from the caption was reverted by him. I removed the image entirely. --82.33.53.103 18:23, 26 September 2006 (UTC)
thread_title:  Removed HoodedHound's image 

message: I removed "Phishers temporarily moved to AOL Instant Messenger (AIM), since they could not be banned from the AIM server." since I couldn't find a reference for it. The rest is (sort of) covered by the two references now in this section. --82.33.53.103 18:35, 28 September 2006 (UTC)
thread_title:  Facts needed in AOL phishing section 

message: Newegg.com's phishing advisory links to this article. I've added an  template, though I'm not sure if this is the appropriate template since newegg isn't a media source. Koweja 15:31, 20 November 2006 (UTC)
thread_title:  Newegg.com 

message: This article needs work and development but is relevant to this article. WP policy is to maximise internal links both for information and to encourage editorial attention. It was deleted from See also. It is not my practice to press edits so I should welcome a discussion as to its suitability, here. TerriersFan 23:06, 26 November 2006 (UTC)
replies: text: TerriersFan, I reverted that edit, and can't imagine why. It was an error and I apologize. I'll put it back, minus the redundant link in the "See also" section. JonHarder 23:24, 26 November 2006 (UTC)
replies: text: Thank you for this constructive response. TerriersFan 23:53, 26 November 2006 (UTC)
thread_title:  [[Website spoofing]] 

message: I removed the following text, after editing it for clarity, then deciding it wasn't phishing. It is, however, an instance of what some have called pharming. There's even a claim that "There are no known instances of pharming causing financial loss" on that article's pages.
Here's the removed (and edited) text:
In another attack, malicious intruders invaded servers of a bank hosting company used by several hundred small banks. The intruders modified the banks' real web pages, so that visitors to the trusted bank sites were redirected to false pages. The intruders could then steal passwords and other personal information entered by unsuspecting customers. The web hosting company recognized irregularities in web traffic patterns of the bank sites, and shut down its web hosting servers to thwart the attack.
Some security experts characterized this attack as a security breach, since phishing typically involves enticement of an unsuspecting person to visit a rogue site by way an embedded link in a spoofed e-mail message. In this case, the attack took a different spin, with breakdown in security occurring right at the source — servers operated by the web hosting company. However, security experts found that banks were not entirely blameless in this episode, too, since this type of attack could have been averted had the banks used two-way authentication to establish and prove the identities of the bank and user.
Here is Goldleaf's own press release
Point to note from George Ou's blog:
* [while] this is technically similar to phishing, it isn’t the same thing
and the definition of phishing in this article agrees with him.
And these are the references: , , 
--82.40.166.44 17:40, 30 December 2006 (UTC)
thread_title:  Banks' servers hacked - not phishing 

message: I don't like phishing. —The preceding unsigned comment was added by 81.35.5.15 (talk) 20:37, 25 April 2007 (UTC)
thread_title:  I don't like phishing. 

message: Do we need a section briefly describing things that are not phishing that are often confused with it?
* Sending malware to infect a system and read keystrokes isn't phishing
* Taking over a bank's website and stealing user details isn't phishing
* Forcing an ISP's DNS servers to send people going to a bank to your own website isn't phishing
Phishing uses social engineering to make people give up information.
--82.33.51.52 18:01, 10 May 2007 (UTC)
thread_title:  Things that are not phishing 

message: Under "Recent phishing attempts" contains an example of a phishing attempt of South Trust bank. South Trust merged with Wachovia and no longer carries the name South Trust.Dreammaker182 03:12, 26 July 2007 (UTC)
thread_title:  South Trust... 

message: There's one presentation by Websense that uses this awful phrase, "whale phishing". Please let's not catalogue minor variations on phishing with silly names. --82.33.51.52 22:13, 12 August 2007 (UTC)
thread_title:  Whale phishing 

message: Well I just thought I'd make this because someone just tried to phish my nonexistent paypal account. Idiots. But anyways I copied there site link, but I'm not sure how to report it. I'll just put it here.
[removed] --72.45.66.160
:Link removed.  One must wonder exactly what is going on when an unregistered user's first and only edit is to post a harmful link.  CliffC 22:58, 14 August 2007 (UTC)
thread_title:  List of Known Phishing sites 

message: The opening paragraph of this article is a direct steal from the Web site cited as a source. GeorgeLouis 04:18, 22 August 2007 (UTC)
replies: text: Good catch, although this is probably only a technical copyright violation since the editor who added it seems to be the author of the material cited -- not plagiarism but perhaps a WP:COI.  I have undone the edit that added it, and also provided a better citation than Jakobsson for the first sentence.  As I stated to him on 9 June (above), "There is no rule against this [citing yourself] that I am aware of, but editors will always wonder about such additions. I suggest you review the guidelines at WP:Conflict of interest and before making edits where you would cite yourself or the group which which you are affiliated, first propose your changes on the article's Talk page." --CliffC 05:09, 22 August 2007 (UTC)
thread_title:  Plagiarism 

message: Was phishing named after the band Phish?
Also, Several NetNanny-type programs block websites about the group as "phishing-related" sites
Doc Strange 17:26, 22 August 2007 (UTC)
thread_title:  Phishing and Phish 

message: I don't understand the section on Wildcard DNS, even when reading the linked definition.  What does the pipe character do in (all browsers?) under XP?  How do those funny names resolve to a wildcard record?  —DÅ‚ugosz
Which section on wilcard DNS? --82.33.50.254 19:49, 12 November 2007 (UTC)
thread_title:  Section needs Improvement 

message: It makes no sense to archive this page, it's not that busy or full - please keep information readily available to readers.  Please contact an administrator to undo this unnecessary action.  --CliffC 04:19, 7 November 2007 (UTC)
thread_title:  Why?  Please undo archiving 

message: Recent trends that might be worth mentioning:
Now that anti-phishing blacklists are offered by Google, OpenDNS, and others, phishing attacks have been developed to overcome the blacklists.
* Phishing URLs in e-mail now usually contain a random component, including random subdomains and even base domains. 
* URL redirection. exploiting vulnerabilities in well-known sites, is now used in phishing e-mails to get around spam filters.  The Alicia Keys incident involved an open redirector plus other attacks.
* Redirection through Flash files is now an established phishing technique. Netcraft called this "Phlashing", but I don't think that's an established enough term to use in Wikipedia yet.
* Redirection via exploitable JavaScript has been seen in blogs.  --John Nagle (talk) 02:26, 25 November 2007 (UTC)
thread_title:  Trends in phishing 

message: "DNS hijacking and other attacks that are used for banking fraud are not all phishing. Please check the definition of phishing."
:I think DNS hijacking is clearly a phishing technique that meets the definition of phishing as stated at the beginning of the article. While DNS hijacking can also be used for other purposes, a (if not the) principal purpose is to "criminally and fraudulently acquire sensitive information, such as usernames, passwords and credit card details, by masquerading as a trustworthy entity in an electronic communication". See the reference I cited. Banking fraud can result from the sensitive information that's been obtained this way, but the sensitive information can also be used for other purposes. Thus I'm restoring this section pending further discussion, referencing the new page for DNS hijacking I've just created. --John Navas (talk) 18:37, 18 December 2007 (UTC)
replies: text: I looked at the article you cited in support; it doesn't describe DNS hijacking as a phishing technique. Do you have any other reliable sources that describe this as phishing? Phishing is all about tricking people into giving up information, using social engineering, with technical trickery to make it more convincing. DNS hijacking is subtlely different - it uses a technical attack to redirect traffic to a malicious site. It relies on an attack on DNS, not on a person. If we broaden the definition of phishing in this way to include DNS hijacking this would - by extension - include other man-in-the-middle attacks in phishing, even if they require no social engineering. --82.33.52.88 (talk) 23:43, 19 December 2007 (UTC)
replies: text: I found an article from 2005 about large-scale DNS hijacking (widely called "pharming") in support of my position: "Pharming attacks are similar to phishing identity-theft attacks, but they don't require a lure, such as a Web link that victims must click on to be taken to the attack Web site.". Perhaps you could add this more recent DNS hijacking of single clients at a time to the pharming article? From a quick read of that article it fits the definition perfectly. --82.33.52.88 (talk) 23:56, 19 December 2007 (UTC)

text: I went ahead and removed the section again. Before putting it back please discuss here. --82.33.52.88 (talk) 16:23, 21 December 2007 (UTC)
thread_title:  DNS hijacking 

message: I introduced this technical solution which is an obvious but, one that was never mentioned. Now, with most browsers having password managers; and many others available for free, this makes a lot of sense. ZEUHUD (talk) 17:49, 31 January 2008 (UTC)
thread_title:  password managers 

message: [Copied from CliffC's talk page]
I added an important global tool to the set of technical solutions for phishing, which you have taken out. There is nothing there that constitutes advertising! Every browser now day s has a built in password manger that all consumers can benefit from. My analysis is completely academic with references.
ZEUHUD (talk) 17:23, 31 January 2008 (UTC)
replies: text: Sorry, but most editors here are good at recognizing edits like this, where the main goal seems to be to provide bedding for a product mention or link. Please take a couple of days to review WP:EL and the other Wikipedia links I put on your user page.  If you happen to know User:E8MXNX, who seems to be editing article password manager with a similar goal of publicizing SignupShield, please pass the word that Wikipedia is not a free billboard.  You might have a conflict of interest as far as SignupShield goes, are you associated in any way with the company?  Meanwhile, I have reverted your latest edits to Phishing, please take it up on that article's talk page and get consensus before adding the link again.  --CliffC (talk) 20:20, 31 January 2008 (UTC)
thread_title:  Suggested link 

message: :Image:Yahoo phishing.jpg is being used on this article. I notice the image page specifies that the image is being used under fair use but there is no explanation or rationale as to why its use in this Wikipedia article constitutes fair use. In addition to the boilerplate fair use template, you must also write out on the image description page a specific explanation or rationale for why using this image in each article is consistent with fair use.
Please go to the image description page and edit it to include a fair use rationale. Using one of the templates at Wikipedia:Fair use rationale guideline is an easy way to insure that your image is in compliance with Wikipedia policy, but remember that you must complete the template. Do not simply insert a blank template on an image page.
If there is  other fair use media, consider checking that you have specified the fair use rationale on the other images used on this page.  Note that any fair use images lacking such an explanation can be deleted one week after being tagged, as described on criteria for speedy deletion. If you have any questions please ask them at the Media copyright questions page. Thank you.
BetacommandBot (talk) 03:13, 12 February 2008 (UTC)
thread_title:  Fair use rationale for Image:Yahoo phishing.jpg 

message: I don't have any cites (my books are at a loss right now), but as a birder (bird-watching for you non-birders), phishing a term used for the sounds you make as you try to lure the bird out of concealment. They caution you when phishing for birds, since over-phishing may cause undue stress on the bird. I know these would probably not qualify as WP:RS, but here's a few:   [http ://www.whatbird.com/Articles_Tutorials/Articles/Review%20of%20Handheld%20Birds.aspx]. I'm not asking that this be considered for inclusion, but just bringing up a possible alternative to the "fish" explanation. Yngvarr 14:53, 12 February 2008 (UTC)
thread_title:  Phishing for birds 

message: "Whaling", a term apparently introduced a few weeks ago by one writer, probably should be considered a neologism per WP:NEO.  --John Nagle (talk) 04:08, 29 April 2008 (UTC)
thread_title:  "Whaling" - neologism problem 

message: The usage of phishing is drifting. At first it was used to describe attempts to socially engineer sensitive information. Now, it is used even if the social engineering is one part of the attack, with some kind of exploit used to actually get the information. Broad brush phishing is treated as different to broad brush email attacks like the "Storm worm", but once attacks are targeted then terms like spear phishing are applied even if the attack isn't "phishing" under the common definition.
It's an important distinction because the defences against the two are different, but most security companies and news sources don't try to point this out. You can fall victim to attacks that don't just use social engineering even if you don't give up information, just visiting a link could be bad for you.
Even more perversely, people keep trying to add things to the phishing article because the aim is banking fraud or stealing personal information, even if no social engineering is used at all.
Techtarget does define spear phishing in the standard way, but other places don't and I haven't come across a discussion of this drift anywhere - so it's not suitable for the article. Any cites for the meaning of phishing drifting like this?
---82.33.52.88 (talk) 09:44, 1 May 2008 (UTC)
thread_title:  Meaning of "phishing" drifting 

message: Why is a citation needed to show that there have been no known homographic phishing attacks?  You can't show a negative in this way so surely you would just need a citation if there were any such attacks.  It's like saying there are no known extraterrestrial civilisations (citation needed).  —Preceding unsigned comment added by 81.86.117.126 (talk) 10:55, 21 June 2008 (UTC)
thread_title:  Citation 

message: this is neet  —Preceding unsigned comment added by 66.142.7.6 (talk) 01:21, 21 June 2008 (UTC)
replies: text: Please specify what is "neat".[Bot mode|When I'm robot-like,;)]--Xp54321 (Hello!,Contribs) 01:55, 21 June 2008 (UTC)
thread_title:  cool 

message: I notice that I've not received any WaMu phishing emails lately. I wonder if the decline in WaMu stock price and the poor financial health of the banking sector in general, has caused scammers to shift the focus to more vibrant companies so as to catch happy (and therefore more easily duped) customers? Pierre.cardoone (talk) 07:00, 21 June 2008 (UTC)
replies: text: How does the bank's stock price affect whether customers who keep their checking or savings accounts there are happy? They don't necessarily own any stock, and their deposits are insured by an agency of the US Government against bank failure. Not seeing any correlation here -- maybe the phishers just pick a bank, work its customers for a while, then move on to another bank? Regards, Unimaginative Username (talk) 08:29, 21 June 2008 (UTC)
thread_title:  WaMu phishing scams 

message: In the lede it says "PayPal, eBay and online banks are common targets." This expression seems less than felicitous. After all, those organizations are more nearly the lures, (in the fishing analogy); the target (fish) is the poor sucker (pun intended!) whose account ends up being looted by the fraudster.
I'm not exactly sure how this might be best reworded. Would someone else care to take a stab at it? Absent counterargument or suggestions, maybe it makes sense simply to replace "targets" with "lures". Publius3 (talk) 15:35, 21 June 2008 (UT)
:"Lure" is good, I have changed that sentence.  --CliffC (talk) 00:16, 22 June 2008 (UTC)
thread_title:  "target" is the wrong word here 

message: I often get phishy emails for paypal--to dispute a claim. I don't click the link in the email, but instead go  to paypals website and login in. often, the link in the email is a web address similar to paypals's web address. For example, I recieved one recently that linked to paypal.info.com instead of paypal.com. You can forward these emails to phishing@paypal.com whicky1978 talk 20:54, 21 June 2008 (UTC)
thread_title:  Phishy emails 

message: Please pardon a bit of original research in the name of a good cause, but the easy answer is: Don't give your bank your e-mail address. They always ask, whether you deal in person or online, but "Just say no". My bank has a secure message system *inside* the online account; i. e. you login, either at your known bookmark/favorite or, for the really cautious, by hand-typing  https://login.mytrustedbank.com. Now, inside the SSL/TLS secure connection, you can send them messages, customer service requests, etc., and they can send you stuff (usually spam-type promotional announcements, but at least they're legitimate). And if you *ever* get an e-mail at UU@emailprovider.com, you know it's forged. Regards, Unimaginative Username (talk) 22:36, 21 June 2008 (UTC)
thread_title:  Easy prevention 

message: When you hover your mouse over a link, around the bottom-left of your screen you will see where that link takes you.  Isn't this all you need to do to not click 'trick'-links?  —Preceding unsigned comment added by Darx21 (talk • contribs) 23:29, 13 July 2008 (UTC)
thread_title:  Links 

message: I was an undergraduate at the University of Camberidge (1984-1987) when there was a security breach in the Computer Laboratory.  BBC Micro workstations had their boot ROMs replaced with reprogrammed ROMs, which asked for username and password information beofre logging the user on to the University IBM mainframe.  The modified ROMs saved the username and password for retrieval by the perpetrator: a student who referred to himself as 'the phisherman'.
86.129.57.229 (talk) 18:46, 13 August 2008 (UTC)
thread_title:  Origin of the term 'phishing' 

message: How do you pronounce 'phishing'?  —Preceding unsigned comment added by 96.20.128.227 (talk) 16:35, 24 November 2008 (UTC)
thread_title:  Origin of the term 'phishing' 

message: I clicked a phishing link in an email, but realized almost immediately it was a phish (oops). I didn't give them personal info, however, did they get any info from me just by my clicking the link?  —Preceding unsigned comment added by 66.245.90.115 (talk) 17:41, 4 December 2008 (UTC)
replies: text: It is unlikely that they would have directly received any personal information from you just by your visiting their site.  However, some phishing sites push down "drive-by downloads" -- malware which installs on your computer as soon as you visit the page (provided you were using a vulnerable browser and computer).  You'd do well to obtain a bootable CD with current anti-virus software on it, and scan your computer for viruses and worms, just to make sure you weren't hijacked.  The computer virus article has some background, but it's rather encyclopaedic, and not particularly oriented towards offering users help.  http://antivirus.about.com/ might be better for that.  Hope this helps.-- era (Talk | History) 07:36, 10 December 2008 (UTC)
thread_title:  what 

message: Just encountered the term whaling used to refer to any phishing activity intended to collect information about or from senior executives (or celebrities or other VIPs?).  Is this particularly widespread?  Does it merit inclusion in the article?—PaulTanenbaum (talk) 17:47, 16 December 2008 (UTC)
replies: text: Term is mentioned already, as aimed at "senior executives and other high profile targets within businesses".  --CliffC (talk) 20:28, 16 December 2008 (UTC)
replies: text: Ooops!  Sorry for being so blockheaded as to fail to search it.—PaulTanenbaum (talk) 13:09, 17 December 2008 (UTC)
thread_title:  Whaling? 

message: The section Phishing#Helping_to_identify_legitimate_websites is a good addition from User:Iangfc, but:
* the style needs a copyedit
* it isn't cited
* it reads like an essay with a strong point of view - it could do with toning down: it has a strong bias against browser vendors and the CAB forum, among others
--82.33.50.145 (talk) 18:35, 21 December 2008 (UTC)
thread_title:  Helping_to_identify_legitimate_websites 

message: ===PayPal phishing example===
In an example PayPal phish (right), spelling mistakes in the e-mail and the presence of an IP address in the link (visible in the tooltip under the yellow box) are both clues that this is a phishing attempt. Another giveaway is the lack of a personal greeting, although the presence of personal details would not be a guarantee of legitimacy. A legitimate Paypal communication will always greet the user with his or her real name, not just with a generic greeting like, "Dear Accountholder."  Other signs that the message is a fraud are misspellings of simple words, bad grammar and the threat of consequences such as account suspension if the recipient fails to comply with the message's requests.
Note that many phishing emails will include, as a real email from PayPal would, large warnings about never giving out your password in case of a phishing attack. Warning users of the possibility of phishing attacks, as well as providing links to sites explaining how to avoid or spot such attacks, are part of what makes the phishing email so deceptive. In this example, the phishing email warns the user that emails from PayPal will never ask for sensitive information. True to its word, it instead invites the user to follow a link to "Verify" their account; this will take them to a further phishing website, engineered to look like PayPal's website, and will there ask for their sensitive information. You can report these phishing emails to PayPal directly. Remember not to use any of the links that your phishing email has provided.
</nowiki>
BuddingJournalist 16:02, 5 March 2009 (UTC)
thread_title:  Phishing examples 

message: In an example PayPal phish (right), spelling mistakes in the e-mail and the presence of an IP address in the link (visible in the tooltip under the yellow box) are both clues that this is a phishing attempt. Another giveaway is the lack of a personal greeting, although the presence of personal details would not be a guarantee of legitimacy. A legitimate Paypal communication will always greet the user with his or her real name, not just with a generic greeting like, "Dear Accountholder."  Other signs that the message is a fraud are misspellings of simple words, bad grammar and the threat of consequences such as account suspension if the recipient fails to comply with the message's requests.
Note that many phishing emails will include, as a real email from PayPal would, large warnings about never giving out your password in case of a phishing attack. Warning users of the possibility of phishing attacks, as well as providing links to sites explaining how to avoid or spot such attacks, are part of what makes the phishing email so deceptive. In this example, the phishing email warns the user that emails from PayPal will never ask for sensitive information. True to its word, it instead invites the user to follow a link to "Verify" their account; this will take them to a further phishing website, engineered to look like PayPal's website, and will there ask for their sensitive information. You can report these phishing emails to PayPal directly. Remember not to use any of the links that your phishing email has provided.
</nowiki>
BuddingJournalist 16:02, 5 March 2009 (UTC)
thread_title: PayPal phishing example

message: What do you call phishing for email addresses, or chat AIM/yahoo logins?  Is there a different term for that?  If so, could it be linked somewhere in this article (at the top as a disambig/differentation in the first paragraph, or at the bottom as a related topic?)~ender 2009-06-14 14:46:PM MST  —Preceding unsigned comment added by 4.240.12.113 (talk)  
:You call it harvesting, and its quite a different topic. --82.33.50.145 (talk) 13:34, 11 August 2009 (UTC)
replies: text: The article E-mail address harvesting covers the topic. Mindmatrix 14:41, 11 August 2009 (UTC)
thread_title:  Clarification/link needed 

message: The intro includes the phrase, 'the first recorded use of the term "phishing" was made in 1996', but this is patently wrong.
The word is in fact recorded, with the right definition, by Scott Adams in a 'Dilbert' cartoon strip on the 12th of August 1995. Furthermore, it seems extremely likely from the context of this image and the fact that the term is not known to appear before, that in fact this strip was exactly where the term was coined.
Link:
http://www.dilbert.com/strips/comic/2005-08-12/
I changed the intro accordingly but it was reverted. Please explain why.  —Preceding unsigned comment added by 203.160.122.141 (talk) 10:02, 8 August 2009 (UTC)
thread_title:  Actual origin of the term 

message: This definition seems restrictively specific. Criminal in what country? What about sites that are benefiting from this type of deception, but are not breaking any laws? Is there a separate term for Phising that isn't used to break the law? Basho (talk) 16:32, 25 August 2009 (UTC)
replies: text: It is classed as a criminal act in the UK under the Fraud Act 2006. Here is the relevant section of the Act (chapter 35) in full. --Panzer71 (talk) 20:03, 6 October 2009 (UTC)
thread_title:  "criminally fraudulent" 

message: Could this be removed from the list of related articles? It makes the crimes these pieces of human waste are committing seem lesser. It needs to be made clear that these individuals are hardcore criminals and that many of them have committed crime in the offline world too. 203.100.212.17 (talk) 04:59, 24 April 2010 (UTC)
thread_title:  White Collar Crime? 

message: good day ! here im .........you need a holiday!! MiszaBot I (talk) 10:59, 1 November 2010 (UTC)
thread_title:  talk page 

message: Now doesn't link to an explanation of the 'spear' bit...  —Preceding unsigned comment added by 20.133.0.13 (talk) 12:58, 28 March 2011 (UTC)
thread_title:  Spear phishing cite note 18 

message: An image used in this article, , has been nominated for speedy deletion at Wikimedia Commons for the following reason: Copyright violations 
;What should I do?
Speedy deletions at commons tend to take longer than they do on Wikipedia, so there is no rush to respond. If you feel the deletion can be contested then please do so (commons:COM:SPEEDY has further information). Otherwise consider finding a replacement image for this article before it is deleted.
A further notification will be placed when/if the image is deleted. This notification is provided by a Bot, currently under trial --CommonsNotification (talk) 03:25, 6 May 2011 (UTC)
thread_title:  File:Presentation Image Grid 1 JPG.jpg Nominated for speedy Deletion 

message: An image used in this article, , has been nominated for speedy deletion at Wikimedia Commons for the following reason: Copyright violations 
;What should I do?
	Speedy deletions at commons tend to take longer than they do on Wikipedia, so there is no rush to respond. If you feel the deletion can be contested then please do so (commons:COM:SPEEDY has further information). Otherwise consider finding a replacement image before deletion occurs.
A further notification will be placed when/if the image is deleted. This notification is provided by a Bot, currently under trial --CommonsNotification (talk) 10:41, 6 May 2011 (UTC)
thread_title:  File:Presentation_Image_Grid_1_JPG.jpg Nominated for speedy Deletion 

message: Runescape and Battle.net are commonly phished.
Right-clicking can be handy to counter both.
Blizzard (BN) case: Phisher's text was a broken URL that, when copied and pasted into browser, led to an error message.
Runescape phishers used Flash. Again, Right-clicking anywhere other than text fields can help discern a Flash module.
Many legitimate emails now do not ask to click a link, but tell the user how to reach the needed feature of the website (such as personal messages zone)
It is always worth trying to reach the supposed origin website manually rather than using in-email links.  — Preceding unsigned comment added by Yura87 (talk • contribs) 20:49, 26 December 2012 (UTC)
thread_title:  Battle.net and RUnescape phishing 

message: Please delete category 'Computer crimes', and add cat 'Cybercrime'.  Cat 'Computer crimes' should not include  any cybercrimes (since Cat cybercrime is a subcat of 'Computer crimes').76.103.213.6 (talk) 23:08, 5 February 2013 (UTC)
thread_title:  Edit Request 2013.2.5 

message: This edit, completely removing well-sourced material, seems inappropriate; no substantial reason rooted in policy supports removal of the well-sourced material. User:Fred Bauder Talk 16:33, 20 February 2013 (UTC)
replies: text: In fact I gave three reasons rooted in best practice ("policy"). Firstly, the paragraph is poorly written; "however intelligent and sophisticated users at Oxford University may be when engaged in their chosen field of study, the tens of thousands of users of the university's network proved easy targets for phishing" is at best coat-racking/journalistic (indeed, it is a paraphrase of the source) and at worst just plain insulting (though I would say that). Secondly, the subsection does not fit within the section in which it was placed, which has an emphasis on history rather than more recent phishing attempts, though that distinction could be better recognised. Thirdly, as I highlighted, the quality of the reference is unimportant: the balance is all wrong. One sentence in the recent attempts section perhaps; another in a place where a better founded point about the link between intelligence and falling for phishing, maybe. But where it was, and at the length it was? No. In any case, I appreciate the BRD.- Jarry1250 [Vacation needed] 17:19, 20 February 2013 (UTC)
thread_title:  Oxford and Google Docs 

message: I didn't find a better reference but 
^ "HSBC Security and Fraud Center – Phishing Scams, Fraud Protection". Hsbcusa.com. Retrieved 2012-09-09.
Is stale. Maybe
https://security.berkeley.edu/content/anti-phish-tip-3 or something similar.  — Preceding unsigned comment added by Dashawn888 (talk • contribs) 18:32, 4 November 2013 (UTC)
thread_title:  Stale References 

message: I doubt the word decends from "password" and fishing", instead "pishing" and "fishing" is more senseful:
pishing (or squeaking) is "A North American term for the practice of attempting to attract passerine birds close to the observer by noisily sucking air through pursed lips or loudly kissing the back of the hand."  
This should be added.--Mideal (talk) 16:19, 6 March 2013 (UTC)
replies: text: Got a source for that? - Jarry1250 [Vacation needed] 23:40, 15 March 2013 (UTC)
replies: text: Took some time, but finally i found those bird watchers websites:. See  and  and don't believe it, but then find this book at Amazons and also Pish. Funny, but in German we also read the commonly used (wrong) definition "from: Passwort harvesting fishing").--Mideal (talk) 12:13, 18 November 2014 (UTC)
thread_title:  Etymology 

message: Substituted at 15:34, 1 May 2016 (UTC)
thread_title: Assessment comment

message: Perhaps it would be a good idea to phishing into two articles with one on the generic topic of phishing while the other relates to spear phishing.
If preferred it could be expanded rather then creating another article.
FockeWulf FW 190 (talk) 19:57, 24 March 2016 (UTC)
thread_title:  Spear phishing 

message: Link 130 is broken and redirects to what appears to be the homepage of a website instead of an article on the website, probably due to a rearrangement of where/how pages are stored or accessed.  — Preceding unsigned comment added by 86.185.222.233 (talk) 17:04, 14 April 2016 (UTC)
thread_title:  Broken Link 

message: Hello Wikipedia Editors,
The chart titled "Total number of unique phishing reports (campaigns) received" is a bit outdated. The information ends in the month of September 2015, leaving October-December 2015 and January-March 2016 (every month since October 2015) out.
Just noting that the information should be updated once again.
Thanks for reading,  KnowledgeIsGoodForYou (talk) 00:38, 14 April 2016 (UTC)
replies: text: Updated. -Offnfopt(talk) 03:24, 6 June 2016 (UTC)
thread_title:  Chart "Total number of unique phishing reports (campaigns) received" 

message: I propose that Page hijacking be merged into Phishing. I think that the content in the Page hijacking article can easily be explained in the context of Phishing, and the Phishing article is of a reasonable size that the merging of Page hijacking will not cause any problems as far as article size or undue weight is concerned. FockeWulf FW 190 (talk) 22:12, 24 May 2016 (UTC)
thread_title:  Merger proposal 

message: The first paragraph of the lede cites a 2014 Microsoft study claiming the worldwide impact of phishing could be as high as US$5 billion. There are two issues here: a) the information is rather outdated, and b) the executive summary of the actual study (as it is currently available from Microsoft) says $2.4B.
=== Outdated source ===
The cited study was performed in 2013 and released in Feb. 2014. Given that phishing attempts have only been increasing over time, it seems reasonable that more recent numbers should be available. A rather brief search yielded some related metrics, such as estimated costs per attempt or business expenditures to protect against attempts and train employees, but a simple, up-to-date, global number eluded me. I could also find no evidence that the Microsoft Computing Safety Index survey was repeated after the cited 2014 release of the 2013 results.
=== Actual number reported in study ===
In addition to the news.biharprabha.com article currently being cited, a number of other contemporaneous articles (Google search) repeat the same $5 billion impact claim. However, the study's executive summary and the identically-named file in the entire study results both contain the following sentence: "The worldwide impact of phishing could be as high as 2.4 billion USD, recovering from identity theft totals 2.6 billion USD, and repairing peoples’ professional reputations costs nearly 4.5 billion USD." It would seem that the $5B value was revised at some point following its initial release and subsequent news coverage, but I have been so far unable to find any admission of this, by Microsoft or anyone else. This just further underscores the need for a better, and more updated, source.
DadOfBeanAndBug (talk) 23:04, 21 May 2017 (UTC)
thread_title:  What is the actual worldwide impact of phishing? 

message: In addition to the news.biharprabha.com article currently being cited, a number of other contemporaneous articles (Google search) repeat the same $5 billion impact claim. However, the study's executive summary and the identically-named file in the entire study results both contain the following sentence: "The worldwide impact of phishing could be as high as 2.4 billion USD, recovering from identity theft totals 2.6 billion USD, and repairing peoples’ professional reputations costs nearly 4.5 billion USD." It would seem that the $5B value was revised at some point following its initial release and subsequent news coverage, but I have been so far unable to find any admission of this, by Microsoft or anyone else. This just further underscores the need for a better, and more updated, source.
DadOfBeanAndBug (talk) 23:04, 21 May 2017 (UTC)
thread_title:  Actual number reported in study 

message: Hello fellow Wikipedians,
I have just modified 16 external links on Phishing. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20050823111335/http://www.shmoo.com/idn/homograph.txt to http://www.shmoo.com/idn/homograph.txt
*Added archive https://www.webcitation.org/5w9Z2iACi?url=http://www.fraudwatchinternational.com/phishing-fraud/phishing-web-site-methods/ to http://www.fraudwatchinternational.com/phishing-fraud/phishing-web-site-methods/
*Added archive https://www.webcitation.org/5w9Z4mv7k?url=http://blog.washingtonpost.com/securityfix/2006/06/flaws_in_financial_sites_aid_s.html to http://blog.washingtonpost.com/securityfix/2006/06/flaws_in_financial_sites_aid_s.html
*Added archive https://web.archive.org/web/20070328150301/http://www.techweb.com/wire/security/186701001 to http://www.techweb.com/wire/security/186701001
*Added archive https://www.webcitation.org/5w9YV2fuL?url=http://www.rajuabju.com/warezirc/historyofaolwarez.htm to http://www.rajuabju.com/warezirc/historyofaolwarez.htm
*Added archive https://www.webcitation.org/5w9YVyMYn?url=http://itmanagement.earthweb.com/secu/article.php/3451501 to http://itmanagement.earthweb.com/secu/article.php/3451501
*Corrected formatting/usage for https://www.irs.gov/newsroom/article/0,,id=155682,00.html
*Corrected formatting/usage for https://www.theguardian.com/world/2014/jan/27/hackers-israeli-defence-ministry-computers
*Corrected formatting/usage for http://www.millersmiles.co.uk/
*Added archive https://web.archive.org/web/20110406114742/https://www.paypal.com/us/cgi-bin/webscr?cmd=_vdc-security-spoof-outside to https://www.paypal.com/us/cgi-bin/webscr?cmd=_vdc-security-spoof-outside
*Added archive https://web.archive.org/web/20051130031140/http://www.zdnetindia.com/news/features/stories/126569.html to http://www.zdnetindia.com/news/features/stories/126569.html
*Added archive https://web.archive.org/web/20090107043554/http://blog.anta.net/2008/11/09/social-networking-site-teaches-insecure-password-practices/ to http://blog.anta.net/2008/11/09/social-networking-site-teaches-insecure-password-practices/
*Added archive https://web.archive.org/web/20061116184842/http://blog.washingtonpost.com/securityfix/2006/08/using_images_to_fight_phishing.html to http://blog.washingtonpost.com/securityfix/2006/08/using_images_to_fight_phishing.html
*Added archive https://web.archive.org/web/20061110132337/http://blog.washingtonpost.com/securityfix/2006/07/citibank_phish_spoofs_2factor_1.html to http://blog.washingtonpost.com/securityfix/2006/07/citibank_phish_spoofs_2factor_1.html
*Corrected formatting/usage for http://www.antiphishing.org/solutions.html
*Added archive https://archive.is/20130414135047/http://consumerscams.org/scam_safety_tips/how_to_report_phishing_scam to http://consumerscams.org/scam_safety_tips/how_to_report_phishing_scam
*Added  tag to http://www.antiphishing.org/
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 05:43, 11 December 2017 (UTC)
thread_title:  External links modified