Every third phishing attack aimed at stealing money: Kaspersky Lab

• 60% of all phishing attacks using fake bank pages exploited names of just 25 organizations
• Fake bank websites were involved in twice as many phishing attacks in 2013

Cybercriminals are trying harder than ever to acquire confidential user information and steal money from bank accounts by creating fake sites mimicking financial organizations.
 
According to Kaspersky Lab’s ‘Financial cyber threats in 2013’ study, 31.45% of phishing attacks were trading on the names of leading banks, online stores and e-payment systems in 2013, up 8.5 percentage points from the previous year (see chart below).

“Phishing attacks are so popular because they are simple to deploy and extremely effective. It is often not easy for even advanced Internet users to distinguish a well-designed fraudulent site from a legitimate page, which makes it even more important to install a specialized protection solution.
 
“In addition, phishing causes reputational and financial damage to organizations that see their brands exploited in phishing attacks,” said Sergey Lozhkin (pic), senior security researcher at Kaspersky Lab.
 
Phishing is a fraudulent scheme used by cybercriminals to obtain confidential user data with the help of fake web pages imitating Internet resources. Unlike malicious software created for particular operating systems, phishing attacks threaten all devices, which can access web pages.
 
Phishing sites aimed at harvesting users’ financial details mainly use the brand names of popular online stores, e-payment systems and online banking systems.
 
In 2013, the most attractive targets were banks, which were used in 70.6% of all financial phishing. That’s a sharp increase from 2012 when bank phishing represented just 52%. Overall, fake bank websites were involved in twice as many (22.2%) phishing attacks in 2013.
 
Last year, Kaspersky Lab’s heuristic anti-phishing technologies blocked a total of 330 million attacks, an increase of 22.2% from the previous year.
 
Fraudsters use the brand names of major companies with large client databases in search of a big criminal profit.  For example, about 60% of all phishing attacks using fake bank pages exploited the names of just 25 organizations.
 
Among e-payment systems the phishers’ favourites are even more clearly defined, with 88.3% of phishing attacks in this category involving one of four international brands: PayPal, American Express, Master Card and Visa.
 
For several years in a row Amazon.com has been the most popular cover for phishing attacks exploiting the names of online stores. Over the reported period its name was used in 61% of online trade-related phishing attacks.
 
The Top 3 also included Apple and eBay, but both of them lagged well behind Amazon. 
 
Phishers don’t just imitate the websites of financial institutions – they also frequently attack via social networking sites.
 
In 2013, the number of attacks using fake pages of Facebook and other social networking sites grew by 6.8 percentage points and accounted for 35.4% of the total.
 
The ‘Financial cyber threats in 2013’ report used data obtained voluntarily from Kaspersky Security Network participants. Kaspersky Security Network is a globally distributed cloud-based infrastructure designed to quickly process depersonalized data about threats which users of Kaspersky Lab’s products encounter.
 
Statistics about phishing attacks were obtained based on Kaspersky Lab web anti-phishing detections.
 
Related Stories:

Phishing scams and the human brain

Big dip in phishing attacks in Malaysia, but …

BolehVPN’s exposé of e-banking security flaws in Malaysia

For more technology news and the latest updates, follow us on Twitter, LinkedIn or Like us on Facebook.