Phishing Scam e mails

missile

dtsazza wrote: »

And I think it is.

You seem to forget that the people sending the phishing emails are both technologically literate, and don't really want to co-operate with being identifiable.

You also overlook that email as a medium was never designed for secure, verifiable exchange.

The only way that phishing emails could be stamped out is some wholesale technological reform - such as everybody insisting on emails being cryptographically signed with a verified key, and auto-deleting unsigned mails. Or a move to a more robust electronic messaging system altogether. (Neither is going to happen due to the network effect.)

Of course, using a webmail service such as GMail goes a long way to preventing you seeing phishing mails due to unintentional crowdsourcing; it only takes a few people to report a mail as spam before the remainder of users won't see it in their inboxes.



But fundamentally, it's not possible to solve. (And if you disagree with that, please list in detail the steps that you'd take to address it, and explain why the spammers wouldn't be able to get around them using their know-how and powerful botnets.)

and you are always right :rotfl:

thenudeone

Do you think the governments of legal backwaters like China or Russia have any interest at all in stopping a flow of money into their countries from the "developed" world? I think quite the opposite is the case.

Russia's constitution prevents it extraditing its own citizens to face any court abroad even for alleged murder, so the chances of the Russian government (for example) doing anything about its' citizens attempting fraud on UK citizens, is zilch.

Even in the UK, fraud is very low on Police priorities. Why? When the public are asked what they think the Police should spend their time on, how many people say: Fraud?

missile

I posted this topic for discussion. I don't expect everyone to agree.

If they can track Jonathan James, Adrian Lamo, Kevin Mitnick, ....

If they can stop P2P, ....

If they can gag WikiLeaks, ....

If the banks made some effort, IMHO they could reduce if not erradicate the problem.

poppasmurf_bewdley

The only way to stop these scam emails is to change your email address every so often.

I had a virgin.net email address for about five years and received loads of scam emails from Halifix, HSBC, Barclays, etc and they were gradually but noticeably increasing. Then when I moved home last year, I changed broadband providers and changed to a Googlemail email address and haven't had a problem since. I've not received a single scam email (to my knowledge). I intend to change my Googlemail address to something slightly different in another 12 months time to keep my address new and away from spammers.

I know it can be a pain to notify everyone of the change but it is worth it if it puts these scammers out of business as it means they'r busy emailing addresses that no longer work.

thenudeone

When I moved ISPs a couple of years ago I found that I couldn't continue to use my own domain name for email through their email servers, so I had to create another solution which just happened to be googlemail.

I am not a great fan of google's business practices (think China) but to their credit, their spam/phishing filters are very effective and only occasionally create false positives.

There is also a trick to help even further. You can create an almost infinite number of variants of your address and give different variants to different contacts. If one starts getting spam or phishing emails, just set a filter to delete all mail to that address automatically.
http://www.makeuseof.com/tag/1-awesome-gmail-tip-you-dont-know-about-seriously/

dunstonh

I feel banks should tackle this issue.

That email is an obvious scam though. There are a number of errors or pointers in there which stand out.

It is not personalised, grammar is poor, the company it reports to be from does not exist, no contact point and the address in the link is
h--p://davcna-blagajna.si/prueba/prueba/prueba/namenewhalifee/mnbvcxz/halifax.co.uk.htm(adjusted slightly-to stop someone clicking it)

dtsazza

missile wrote: »

and you are always right :rotfl:

Of course!

Asides from that, I acknowledge that it's only my opinion. But it's impossible to prove a negative; my view is that there is no reasonable system, or course of action, that would achieve what you're aiming for. If there is one - which there could well be - then simply describing it would be enough to make me revise my opinion.

missile wrote: »

If they can track Jonathan James, Adrian Lamo, Kevin Mitnick, ....

If they can stop P2P, ....

If they can gag WikiLeaks, ....

If the banks made some effort, IMHO they could reduce if not erradicate the problem.

For one thing, all of those cases are quite distinct from phishing emails. You can't generalise from "the authorities stopped something illegal on the internet" to "the authorities can stop anything illegal on the internet".

Also I'm pretty sure they haven't stopped P2P in the slightest. If anything the P2P situation supports my side - specific networks have been taken down here and there, ISPs have been served subpoenas, and many individual users have been summoned to court etc. But at the end of the day, it's just as easy if not easier to access copyrighted material over P2P networks now than it has ever been.

(As a technical aside, P2P is merely the technology to share any files peer-to-peer, and it's a solid principle. The use of it to distribute files illegally is merely a subset of its capabilites, and it's wrong to associate the technology with the crime. In that light, P2P doesn't need to be stopped.)

Wikileaks is a similar story - it's still up, and while there were issues with that one particular site for a while, mirror sites arose to provide the content and add extra leaks. Even if Wikileaks is allowed to continue in a quiescent state where it doesn't publish anything the authorities don't like, then another site will crop up that does publish those leaks. And if/when that's knocked down, another will arise.

The individuals you've named were exactly that, individuals who committed major crimes and were pursued by large-scale investigations from the authorities. The comparison to scam emailers is not apt - there are tens if not hundreds of thousands of them on the internet. Spend several man-months investigating and closing down one, and you've made no impact.

Ironically the closer you get to shutting down all spammers, the bigger the rewards there will be for prospective new spammers to enter the market - and that's assuming that the conviction rate would somehow be bigger than the natural rate at which new spammers start up anyway (highly unlikely).


The bottom line: If you can't investigate and shut down a spammer in less time than it takes for them to set up an account to start sending bulk emails, you will not be able to stop them. And since it currently takes just a few seconds to set up an anonymous account - you will not be able to stop them, until or unless the whole system is changed to make setting up accounts harder, and tracing internet activity to one individual much easier.

ashleypride

missile wrote: »

and you are always right :rotfl:

And in this case he is spot on. If you don't agree with what he is saying, chances are you really don't understand the problem.

missile

dtsazza wrote: »

Of course! .

Thanks for your comments.

I raised this issue to stimulate some discussion from those more knowledgeable than I. I did anticipate that most would not agree with me.

It is easy to identify the orinator IP address and then block their access. As you said G Mail and other ISPs already have a rudimentary system to do just that. I do appreciate that does not solve the issue but I would suggest it would be a start.

When I lived in spain one of the ISPs had a dreadful security system and a.n.other providers blocked all traffic from Terra.es until they improved their systems.

ashleypride

missile wrote: »

It is easy to identify the orinator IP address and then block their access. As you said G Mail and other ISPs already have a rudimentary system to do just that. I do appreciate that does not solve the issue but I would suggest it would be a start.

Err, that happens now. Generally, spam comes from 'bullet proof' servers, infected machines, or accidental open proxies. By the time the bank reports it and action is taken, the spammers have moved onto another host. The banks cannot do anything to stop the spam.

Most effort (rightly so) by the banks is directed to those hosting the phishing sites.