10 February 2010
The South African Banking Risk Information Centre has expressed concern about the increase in “phishing” attacks, and is urging local bank clients to be extra vigilant with their banking information.
Phishing occurs when criminals make use of mostly e-mails purporting to be from legitimate financial institutions in an attempt to get users to divulge information such as usernames, passwords and credit card details.
The centre said the local banking industry was particularly disturbed by the realistic nature of the phishing e-mails that around doing the rounds, which point to well orchestrated scams by the perpetrators.
“Banking industry data managed by Sabric shows that the number of phishing websites targeting local bank clients that have been detected and shut by the banks have more than trebled in the last four months,” said Sabric chief executive Kalyani Pillay in a statement this week.
“This is really unprecedented and a clear sign of the extent of the onslaught.”
The centre advises bank clients who suspect that they may have provided their banking information in response to an email request to immediately notify their banks.
“While the shutting of phishing websites serves to prevent more people falling victim, the perpetrators are still able to use the information that they had already managed to collect,” she said.
Phishing emails
According to SABRIC, the content of phishing emails is now no longer limited to the usual pretext of security alerts from bank online divisions, consumer education information, and other related information that a bank client would expect to receive from their bank to dupe them into accessing fake or spoof websites.
As many clients have become alerted to the fact that they should never expect to receive an e-mail of this kind from their bank, a newer generation of phishing emails, for instance, pretends to originate from other organisations such as the South African Revenue Service, enticing clients to supply their details in order to receive “tax refunds”.
“While there is very little change in the chain of events that eventually lead to sensitive banking information of a bank client being compromised, it is clear that the perpetrators have now customised their approach to make their scams more believable to a typical SA bank client,” Pillay said.
She pointed out that instead of just a single word, the phishing e-mails now contain references to the website names of local banks in their entirety, which makes it even more difficult for clients to dismiss the e-mails as part of a scam.
“We urge bank clients to stay alert so as to avoid falling victim.”
‘Ignore email requests’
The centre says that the message contents of the recent phishing e-mails also appear extremely authentic – while perpetrators previously targeted only a single bank at a time with a given phishing e-mail or website, they now had cleverly constructed variations on the old theme that manage to target clients of multiple banks simultaneously, thereby increasing the perpetrators’ chances.
“For this reason we remind bank clients that not only will your bank never send you an e-mail requesting you to update your information online by accessing their site via a hyperlink, but you should also view with extreme suspicion any similar e-mails received from third parties requesting you to log into your internet banking facility,” explained Pillay.
“Any such requests should automatically be considered a phishing scam.”
Bank clients are advised to contact their banks first before responding to any requests of banking information.
SAinfo reporter
Would you like to use this article in your publication or on your website? See: Using SAinfo material
