UAE banks attract ‘phishing’ interest

Not long ago, the targets of online identity thieves were mostly international banks, which meant that the local banks in the UAE were relatively free from the menace.

But this is no longer the case. Recently, there has been a noticeable increase in the number of e-mail spoofs directed at customers of local banks.

The UAE banks have since launched a media campaign to warn their customers against ‘phishing', a form of online fraud that uses spoofed e-mails to lure recipients to fake websites. But the counter-measures are never known to be smarter than the ways fraudsters employ.

The spam-masters have perfected their craft into such an art that it is nearly impossible to make out the fake from the real. The fraudulent websites hijack the trusted brands of well-known banks, online retailers and credit card companies, seeking to trick customers into divulging credit card numbers, account login names and passwords. Citibank and HSBC have been among the hot favourites of the fraudsters.

Data compiled by an anti-phishing working group suggests that phishers are able to convince up to 5 per cent of recipients to respond to them.

The Anti-Phishing Working Group is an industry association focused on eliminating the identity theft and fraud that result from phishing and e-mail spoofing.

The group has reported a massive increase in the number of phishing sites since the first week of last month. The one common theme of the phishing sites is that nearly all are hosted on IP addresses mostly outside the US, the group said. There is no mention of the UAE on the list of countries hosting such sites.

The group believes that the sudden spurt in the spoofing activity may be due to the availability of some sort of toolkit for easy execution of the fraud. There is also evidence of multiple brands being spoofed from the same machine over a few days. For example, the sites rotate their targets on a daily basis, with several versions of the content moving from one site to another.

According to the group, the maximum number of phishing sites are still hosted in the US, although the percentage has shown some decline, with a 29 per cent fall in October.
China, Korea, and Russia are next on the list with 16 per cent, 9 per cent, and 8 per cent respectively of the total sites hosted.

While there is still a fairly high concentration of activity involving a few well-known brands, the specific high-profile brands shift from month to month.

The group found that while nearly every measure of reported phishing activity is on the rise, the number of hijacked global brands has remained more or less the same.

There is no mention of the UAE brands on the group's list, which means that the spoofing attempts involving these names may be localised.

The UAE banks appearing on the radar screens of the spoofers may be an indication of the growing power of their brand names, but the ‘distinction' will surely bring no credit to the banks.

K. Raveendran is a UAE-based journalist