posted by
bugshaw at 10:41am on 21/10/2008
![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png)
I receive a lot of phishing scam emails through my cix account. I use a text-only reader, and hyperlinks are displayed in a different colour so they stand out. These emails typically include a lot of links to images and such on a bank's bona fide site, presumably to add an air of legitimacy to a spam filter and/or to keep the email small by not including the images as jpgs.
Somewhere in the email is a link to the phishing domain, usually hidden beneath something that looks initially plausible in a browser or so that you cannot see where the link leads. Like these examples:
<a href="http://phishers.com/www.realbank.co.uk/">https://plausible-looking-login-url.realbank.co.uk/</a>
<a href="http://phishers.com/realbankcustomers.php" target=_blank type=hidden>Restore Your Realbank Account Access</a>
Given the reliance on hotlinking to elements on real bank sites, would it be a useful measure for banks to adapt their images so that if displayed other than through one of their known sites it appears as a phishing warning message?
Yes, scammers would soon find a way around this but it might throw a light on the scope of the problem for a few days, especially to the less technically savvy/suspicious.
Somewhere in the email is a link to the phishing domain, usually hidden beneath something that looks initially plausible in a browser or so that you cannot see where the link leads. Like these examples:
<a href="http://phishers.com/www.realbank.co.uk/">https://plausible-looking-login-url.realbank.co.uk/</a>
<a href="http://phishers.com/realbankcustomers.php" target=_blank type=hidden>Restore Your Realbank Account Access</a>
Given the reliance on hotlinking to elements on real bank sites, would it be a useful measure for banks to adapt their images so that if displayed other than through one of their known sites it appears as a phishing warning message?
Yes, scammers would soon find a way around this but it might throw a light on the scope of the problem for a few days, especially to the less technically savvy/suspicious.
There are 8 comments on this entry. (Reply.)