Phish Fraud Losses an Exaggeration?

NEEDHAM, Mass.- A TowerGroup research report titled A Phish Tale? Moving From Hype to Reality finds that despite the media attention to email “phishing” scams, direct fraud losses attributable to phishing may be less than expected. The actual dollar value of phishing-related fraud is expected to total just $137.1 million globally in 2004. “Phishing attacks can allow criminals to fraudulently obtain consumer data, but they do not as commonly result in an actual fraud event in which accounts are accessed or funds are stolen,” said Beth Robertson, senior analyst in the Global Payments research service at TowerGroup and co-author of the research. The report also finds that the true number of phishing attacks will total more than 31,000 globally in 2004 and is expected to rise to over 86,000 by 2005, as the phenomenon spreads to customers of smaller financial institutions, new merchant/service-provider categories and new global markets. Phishing has also become more advanced and multifaceted as organized crime rings have taken over much of its development. Not only has the quality of fake e-mails improved, but more effective targeting is increasing the efficiency of phishing attacks. Phishers are also integrating their scams with malicious software (or “malware”) downloads, as well as complex new variants better classified as “malware attacks” than as phishing – making the threat from these attacks more dangerous and more difficult to detect and prevent. While the study finds that phishing attacks are successful in fooling only a very small fraction of the online population and are, to many consumers, a nuisance like spam, it has the potential to negatively affect consumer confidence in the Internet as a viable channel to conduct commerce. “Ultimately the total cost of managing this growing menace will be far greater than the cost of direct fraud,” said George Tubin, senior analyst in the Delivery Channels research practice and co-author of the research. “One of the greatest liabilities is the potential loss of customer confidence in the Internet as a channel for provisioning financial services, not to mention loss of trust in financial institutions themselves. This is a critical issue, given the rising importance of the online channel in the retail financial services delivery mix.”