Small Fry, Such as Credit Unions, Now Increasingly Hijacked by Phishers

Smaller financial institutions, including credit unions, are increasingly coming under attack by phishing fraudsters, according to the latest report from the Anti-Phishing Working Group. The report says the number of brands “hijacked” by fraudsters jumped to 107 in May, up from 79 in April and 64 in January. The group, a consortium of financial institutions, online merchants, software companies, payment networks, and law-enforcement agencies, attributes the increase to what it says is “a major increase in the number of small and local credit unions” targeted by phishers. Nonetheless, some seven brands are victimized in 80% of all reported phishing campaigns, says the report, which does not list the brands. Meanwhile, the number of reported Web sites engaged in the fraud also climbed in May, with the group registering 3,326 sites, up 16.5% from 2,854 in April. Indeed, the number of phishing nearly tripled in the seven months between October and May. The average length of time a site stays online is 5.8 days, with the longest time recorded being 30 days, says the report, which the APWG publishes monthly. The number of phishing reports the group received in May, however, did not grow so sharply, reaching 14,987, up 4% from April and representing a “continuing trend of slight growth during 2005,” says the report. More than one-third of the sites are hosted in the U.S., more than any other country. China, which hosts 15%, comes in second, though the APWG says China's number dropped in May for the first time since it began tracking the phishing trend in November 2003. In phishing attacks, criminals send mass e-mails, and set up Web sites, that use graphics and slogans that mimic those of actual, trusted entities, such as banks. The e-mails usually use urgent, bogus warnings of “system changes” or other activities to trick recipients into visiting the sites and entering sensitive data, such as passwords and PINs.