How Well Do Businesses Respond to Phishing Reports? 90
FuzzyDaddy asks: "When I receive a phishing email, which I find has some new or interesting technique, I will usually forward it to the appropriate abuse department. I recently got one concerning 'my' paypal account (surprising, since I don't have one), which I forwarded to abuse@paypal.com. I received an automated reply telling me to 'please direct all customer service inquires through our website.' I didn't have time to do that, so I let it go. Is paypal being irresponsible, here? Have others on Slashdot been satisfied with their attempts to report Phishing?"
Comment removed (Score:5, Informative)
Re:Wrong address. (Score:5, Informative)
Always include original full headers.
You might also want to submit phishing scams to reportphishing@antiphishing.org.
Re:Wrong address. (Score:2)
I wish they would make this clearer (or if they do, I wish they did it better in the past). About a year or two ago I got a phishing email pretending to be from eBay. I sent it to abuse@ebay.com but got a form letter telling me to go through their web site (and not only that, the form REQUIRED that I log into my ebay account - so if I didn't have one, I would have no way to report phishing, which is absurd). So I just let it drop. I'm trying to do them a favor, but I don't
Re:Wrong address. (Score:2)
RFC Ignorance (Score:2)
Yet another example of big Companies ignoring internet standards.
http://www.rfc-ignorant.org/policy-abuse.php [rfc-ignorant.org]
Re:Wrong address. (Score:3, Insightful)
(something like)
ProxyPass / http://www.ebay.com/ [ebay.com]
ProxyPass / https://www.ebay.com/ [ebay.com]
and then just log all the mitm data they are interested in
Re:Wrong address. (Score:1, Interesting)
Only stops the low-tech phishers (Score:3, Insightful)
Now that banks are issuing one-time passwords and SecurID tokens, reports are that some phishers have invested in the software and infrastructure to do real-time man in the middle attacks. They talk to the genuine version of the web site they're impersonating and pass along your credentials. If you supply the wrong password, they echo back the "invalid login" from the real site.
I'm currently recommending "go to your bank
Re: (Score:2)
Re:Wrong address. (Score:1)
If you do use the username/password, make the username about 32 random alphanumeric characters. The less likely it is a real username, then the less impact to innocen
Re:Wrong address. (Score:1)
That's why you make the username something obscene. SOmethignthat Ebay (or whoever) would never allow as a real login.
Re:Wrong address. (Score:1)
Re:Wrong address. (Score:2)
Names like are my favorites.
Re:Wrong address. (Score:2)
The FBI is coming
Re:Wrong address. (Score:3, Informative)
Eivind.
Re:Wrong address. (Score:1)
That's a really good idea, thanks. I'm going to get my family to do the same.
Our reports aren't very important (Score:5, Interesting)
With that said, those hosting the phishing sites have been very responsive. I came across a paypal phish on poly.edu's network, emailed abuse, and it was gone when I checked an hour or so later, along with an email response in my inbox. Problem is that the burden of enforcement is more on the company being phished than the source of the attack.
Re:Our reports aren't very important (Score:2, Informative)
Re:Our reports aren't very important (Score:3, Interesting)
Also, why is the email header information so important? I presume the email came from a zombie machine
Re:Our reports aren't very important (Score:3, Insightful)
Paypal security center - "Alert us to fraud" (Score:5, Informative)
Paypal, eBay, Amazon, etc all have pretty good security centres. I am surprised that abuse@paypal.com gave that automated reply, but if you visit their website the security centre is prett yeasy to find. You might not get a personalised response to your report because they get so darn many reports, but they do follow through on all reports.
Re:Paypal security center - "Alert us to fraud" (Score:3, Informative)
I'm not a fan of PayPal by any means (I refuse to use PayPal myself) but I do know that they (and parent company eBay) take phishing reports seriously.
Re:Paypal security center - "Alert us to fraud" (Score:3, Insightful)
Personally, I sort ALL that crap to the JunqueMail folder and make it all go away about daily.
Personally also, I've always looked at my fellow man as a like minded person, but the last 65+ years has taught me ther
Someday, take a look at those phishing websites (Score:4, Interesting)
Outside of the actual businesses (Score:4, Informative)
Similar experience with Ebay (Score:2)
Twice I got an 'ALERT: Your email has not been received by eBay.' email.
Finally I figured they need 'Fw:' in the subject title.
keybank.com was even worse they never responded back and the phishing site was available for several weeks after I submitted a report.
Bank of America (Score:3, Interesting)
And no, I didn't send them feedback on how they could improve their website.
Re:Bank of America (Score:4, Interesting)
Anyway, I got a reply, from a real person, telling me they needed my account number in order to proceed. I told them I didn't have one, and that I only forwarded the information to them so they could stop possible fraud. They replied that they still needed my account number to proceed.
My final response to them was not very kind, and I never heard back from them again. I'm certain the profanity in it caused them to dump my 'case' right there. Too bad for their customers. Luckily, I won't ever be one.
H.
Re:Bank of America (Score:2, Insightful)
Boy, that's a tough break. If only there were some technological method that would allow you to put a fake email address in the form, or some free webbased email account you could sign up for and then discard immediately afterward.
No, sir, once they outlawed Hotmai
Re:Bank of America (Score:2)
Re:Bank of America (Score:2)
I understand and agree. So, lie. You have no relationship with them, other than that you're trying to do a nice thing, right? I see nothing in that arrangement that obligates you to being honest about your identity.
Re:Bank of America (Score:2, Insightful)
And for the record, since I
Re:Bank of America (Score:1)
You never have to worry about giving out your email address & getting flooded with spam.
RFC Violation (Score:4, Informative)
Re: (Score:2, Informative)
Re:RFC Violation (Score:2)
I tried emailing a week later, and it got through this time to get another automated message saying it was being looked into. Weeks later, and the scammer still has their email account wor
Re:RFC Violation (Score:3, Interesting)
I read elsewhere that 75% of what is coming OUT from Hotmail/MSN server is spam of one sort or another (and apparently mostly phishing and similar scams based on what I've gotten in the past). It's time to just refuse all email from Hotmail/MSN servers ... except for specific email addresses you know of by whitelisting them. This is what I have had to do (because Hotmail/MSN reached the point of representing more than 50% of all incoming spam because I've been rather effective at blocking spam from lots o
Re:RFC Violation (Score:3, Informative)
Go ahead, I'll wait.
Re:RFC Violation (Score:2)
There doesn't need to be any RFC. I simply send reports to abuse@${serverdomain} and ignore auto-replies. Once any one domain reaches a count of 3 separate incidents of spam, then no further email is accepted from that domain and no further reports are sent to them (the third and final report does say that they are now blacklisted due to our "three strikes" policy). One exception is if it is a case of a zombie machine operated by a customer of the ISP whose domain is in reverse DNS, and they provide a su
Stop spamming, thanks. (Score:2)
Re: (Score:1)
Re: (Score:1)
yahoo sends you an automated response.. (Score:2)
Ditto. (Score:3, Interesting)
I managed to get the phisher's two Web sites shut down by dot.tk's abuse department. So, the second time phisher came on to spam
Re:Ditto. (Score:2)
I'm going to get my roommate to start using this instead of mozilla.
Re:Ditto. (Score:2)
It isn't really abuse(of Paypal). (Score:1)
Re:It isn't really abuse(of Paypal). (Score:3, Informative)
Re:It isn't really abuse(of Paypal). (Score:2)
Considered sending paper mail? (Score:3, Insightful)
Personally, I feel email is not a reliable way to make first contact with someone, unless you have some arrangement made with them in advance. While email sent to abuse@ and postmaster@ should always be read by a live person, many spammers send bulk email to abuse@ and postmaster@ addresses. Any published email address is likely to receive a large number of unwanted email messages, and anyone who reads mail at that address must spend extra time removing unwanted messages. Sometimes important messages are deleted or ignored by mistake.
Some companies ask to be contacted by email. They might publish a customer service email address on their web site, or publish a 'Contact Us' page which lists email addresses which can best handle different kinds of issues.
If you just guess an email address, or if you send mail to a published address where the recipient hasn't requested your email, I don't think you can assume your email will always be read, or that you can fairly call a company irresponsible for failing to read your unsolicited email.
Phone calls, faxes, and paper mail require more effort than an email message. If a company doesn't respond to an email message, but you really are interested in helping them find this web site, it might be worthwhile to look up their fax number or mailing address, and contact them that way. If you don't really want to help them, you don't have to. It's completely optional.
Why bother? (Score:3, Insightful)
So, your helpful report (along with a few thousand others) is likely to be met with either silence or open rejection. There isn't much they can do, and it is unlikely they can do much for the fools that fall for such scams. If you believe you bank is going to send you email from a host they don't have their domain name on, you will believe anything. More over, these days if you think your bank is going to send you email at all you are being silly. They already figured out that email is useless given the density of spam.
The problem is the target is helpless. It is up to people to stop responding to this stuff. If we aren't going to go after the people that send this out, what do you want the target to do?
Banks send legitimate e-mail from other domains (Score:2, Informative)
a host they don't have their domain name on, in my experience.
I don't have a bank message in my current inbox but Discover Card,
for example, sends e-mail from arm149.bigfootinteractive.com. The
bigfootinteractive.com web site (which I believe is legitimate) says
it's a "leading provider of strategic, ROI-focused email
communications solutions."
Actual banks, credit unions, etc. use similar e-mail outsourcing.
The messages that give me short https UR
Re:Banks send legitimate e-mail from other domains (Score:2)
What is the use of using a service to send email when that service has a bad reputation and is on a lot of spam lists?
Yes, there are things they can do! (Score:5, Interesting)
The first thing they could do is to publish SPF records for their domains. And not the ones that end in "~all" ("and accept any other IP, in case we forgot one") like AOL, HOTMAIL, and many other sources whose domains are faked constantly use. The ability to tell your users "Hey, this didn't come from who it is claiming to have come from" is a start. But PayPal, eBay, and most banks I've seen scammed have no inkling of how a simple change to their DNS would protect them and their customers.
The second thing would be to tell their web servers to not serve images up that have the wrong referrer. Hey, referrer checking isn't 100%, but any time you have an image request from a victim of one of these scam mails, it would be a lot better if that picture had "THIS IS A FRAUD MESSAGE" overlayed on it. It would force the scammers to go back to hosting the pictures on the scam site, which is a harder to do than simply uploading a single script to a slightly-insecure website in Brazil or Ohio. And the emails are as legitimate looking as they are because they use the scammed bank's own graphics, from their own servers!
Re:Yes, there are things they can do! (Score:2)
I, personally, tack on +2 in SpamAssassin for softfail (~all) and +4 for fail (-all), but I leave it alone for neutral (?all).
Re:Yes, there are things they can do! (Score:3, Interesting)
Unless the forwarding account is SPF aware (which is not trivial to do) legit e-mail will say its from ebay.com but the ip will be for forward-mail.com and ebay won't be able to send e-mail to those customers.
Until everyone makes sure their servers are SPF compatible I can't see how companies like ebay can possibly use SPF records and reliably get their mail to their customers.
Re:Yes, there are things they can do! (Score:2)
I live in Ohio, have for most of my life. Brazil should be deeply offended.
Re:Why bother? (Score:3, Insightful)
Here's where I'd draw an analogy to the credit card business. Credit card companies did not used to be liable for fraud, and did very little to protect people from it. In fact, they would do things that were very insecure (like sending out live, unsolicated credit cards to people, that would get intercepted and used by thieves.) It was a huge problem, and it was eventually solved by Congress limiting individual's liability in credit card fraud cases t
Halifax and Cyota (Score:3, Informative)
I recently received a phishing mail pretending to be from Halifax (a UK bank). I clicked the link and it worked so I forwarded the mail to the address (onlineemailinvestigations@hbosplc.com) listed on their real web site [halifax.co.uk]. I've done this before and got the usual instant form response but this time I got that and a bounce message saying that my message could not be delivered to HBOSfeed@cyota.com. Cyota [cyota.com] appears to be a company which Banks outsource their phishing responsibilities to.
I figured this was just a misconfiguration somewhere so I tried mailing postmaster@cyota.com and that bounced too so I think I then filled in the Contact Us form on their web site (I'm not certain if I got round to doing it, but I think I did). Next time a phishing e-mail came I forwarded it as usual but I got the same bounce so this time I tried mailing postmaster@hbosplc.com. This one didn't bounce so I figured someone was sorting it out.
Then yesterday another phishing e-mail came so I forwarded it to the designated address again and got the same bounce again. Now I'm out of ideas, but to answer the original poster's question: In the case of Halifax and Cyota, I'd say, "not very".
Re:Halifax and Cyota (Score:1)
It seems that their database has either been stolen, or they've sold it to the phishers.
Nationwide don't even have an address to forward phishing attempts to as far as I can tell.
Re:Halifax and Cyota (Score:1)
My previous post on this topic (Score:2)
It's nice to see that nothing has changed as far as the banks go.
Yahoo doesn't respond (Score:4, Funny)
A week ago, I got a phishing scam that used the address http://paypal-com-us-ssl.info/ [paypal-com-us-ssl.info] for its responses. At the time (it's dead now), that address resolved to a YAHOO server. So, I reported it, including the whole phishing message, with headers, to abuse@yahoo.com.
Their response? Don't know - their abuse@yahoo.com address has a spam filter on it, which rejected the message because it contained a phishing scheme:
If you do nothing... (Score:1)
A few addresses I keep ->
abuse@bankofamerica.com
internetsecurity@barclays.co.uk
spoof@ebay.com
abuse@msn.com
spoof@paypal.com
identitytheft@skifi.com
from the other side (Score:4, Informative)
Suffice it to say we took action ASAP. I have a feeling they would have forced us to do something about it if we dragged our feet. I'm assuming they do the same for other reports they receive.
Very Similar Experience (Score:2)
company vs robot swarms (Score:2)
it is just too easy to create large swarms of automated, online agents - each of which can cause huge numbers of incidents.
Yes, they should do their best (because if the problem continues, it will hurt their bottom line) - but really this is a social/criminal problem and companies don't have the authority to impose any real penalty on people doing this. in our world (now) only governements have that a
FedEx botches it (Score:4, Interesting)
I've been referred to you by FedEx tech support, with the case number above.
Attached is an obvious phishing scam using the FedEx name. It has the usual hallmarks of a phishing scam:
1. A forged return address "aroundtheworld@fedexemails.01o.com", while it was actually sent from "snd6222.britecast.com". (This, of course, is a criminal violation of the CAN-SPAM act.)
2. Phony links to fake sites: the link supposedly to "nba.fedex.com" actually goes to "http://fedex.00b.net/ajtk/servlet/JJ?H=h3cq6&R=28 6452495".
So this is a clear phony.
The real concern is that the sender of this message has some information about our FedEx account. The message contains the line
"All shipments must be paid for with your FedEx account number ending in 811."
That is in fact from our valid FedEx account number. So FedEx appears to have a security breach; account numbers have leaked to a scammer.
Full message source appears below.
Please let me know immediately if we need to cancel our FedEx account because of this security breach. Thank you for your attention to this matter.
FedEx reply:
Dear John:
We received your inquiry. Thank you for contacting FedEx. We apologize for the inconvenience.
We would like to inform you that you may need to contact your local FedEx Account Executive so they can further advise you of what you need to do regarding the status of your account.
We hope this information is helpful. Again, thank you for contacting FedEx.
Note that they've referred me back to the part of FedEx that referred me to them. So that's FedEx, clueless.
My Webhost (Score:1)
Re:My Webhost (Score:2)
The very first time I decided to do this, I discovered the hosting firm was in China, and thought "uh-oh, this is never gonna work. What Chinese firm is going to care if stupid Americans are getting scammed?" But I sent the email anyway.
I got a letter of re
abuse.net (Score:1)
accessviolation@paypal.com (for paypal.com)
postmaster@paypal.com (for paypal.com)
spoof@paypal.com (for paypal.com)
Maybe they get too many phishing spams to abuse@
The other side (Score:3, Interesting)
We caught it three weeks in the act. I analyzed the code, and made a script that would randomly send the receiver (a yahoo e-mail address) random login information (made from first and last name files downloaded from the US census bureau). Now, it's been running for at least three months.
The ph151ng page has been left intact, except that it does not report back to the original receivers, but instead shows a message that basically says "you've been phished, sucker!!!". And at least 200 people a day still get sucked in after three months!!!
I guess I will put google ads on the page...
Who to complain to (Score:2)
Unfortunately, there seem to be a lot of providers who just ignore their abuse emails. Phishing scammers seem to use small, poorly managed providers that just don't have it together to respond to abuse complaints.
After being ignored about a fake MSN site, I did contact MSN support
*Sigh* some peoples mothers children (Score:1)
Worked in online banking (Score:2)
I kept up with a colleague there who related that an actual phishing exploit had occurred (not through the hole I reported) and was reported by a member. Apparently, management was in a tizzy and thrashing about madly. It was suddenly priority #1 and no one worked on anything else unt