I've been Phished, Again !

Holy cow! 

So you are claiming that you can actually fight phishing by increasing email traffic from banks? I think it only makes the customers more confused when you have to keep adding "security features" to something that is as secure as a postcard (anyone on the way can read it) to start with. How long do you think it takes for the phishers to push out messages with the same "security features" on top?

The only way to REALLY fight this is to educate customers that "Your bank never contacts you via email". This is where the customers can really spot the phishing messages, since all of them are fraudulent.

The way to deliver electronic messages to and from customers is inside the internet bank. Once you are logged in, the secure browsing session provides a stable and usable channel for customer dialogues.  

Hi Kalle,

YES - I'm saying that by NOT sending email to customers and educating them on what to expect, their customers are left wide open to phishing attempts.

Banks have tried the "We will not send email" route and the sad result is that phishing has increased.

So my view is that we can't stop phishing. We can make it more difficult by adding technology and education to the mix. A good start is adding SPF to your DNS and DKIM to the email headers (effectively signing the mail as authentic). These 2 technologies alone will have a huge impact on the amount of phishing email that actually gets to the inbox.

But more important is that education of what to look for in legitimate email is the key to reducing the number of victims of this type of fraud. If customers are receiving legitimate emails that enable them to identify that the emails are from their bank (personal data in the email) then when the phishing emails arrive it will be easy to spot them.

I don't think this will eradicate phishing as a fraudulent activity - but if we reduce its effectiveness then we're part way to winning the battle.

The legitimate emails should have features that can't be easily replicated - like the last 4 digits of my account number and mobile phone. This information on the face of the email enables me to know that the sender is someone that knows me.

I'm not saying that a fraudster can't get hold of this information - but the process of sending millions of phishing emails out so that you get a tiny % of people to click that link will be much harder if you need everyone's details.

Part of what I'm saying is a reality anyway - banks are sending millions of marketing and service emails every month. What they need to do is be consistent in their identification, authentication and verification tools and techniques and ensure that they educate their clients about these every time.