29 August 2014

Martin Bailey

Martin Bailey - Temenos

18 | posts 57,415 | views 8 | comments

Online Banking

This community is for discussion of developments in the e-banking world, including mobile banking. This can include all the functional, business, technical, marketing, web site design, security and other related topics of Internet Banking segment, including public websites of the banks and financial institutions across the globe.

Are people really that gullible?

11 September 2012  |  4938 views  |  3

I'm not, by nature, a suspicious man. But whenever I receive an unsolicited email from an institution with which I hold any kind of account, I resist the convenient temptation of clicking on the link in the email. I always go to my browser and type the address in myself - it's the only way to be sure.

I assumed that everyone else did the same, but apparently not. According to figures from Trusteer, the security software vendor, Phishing attacks are frighteningly common and a large number of people fall for them.

If their figures are to be believed, a staggering 45% of bank customers who are redirected to a phishing site divulge their credentials. They estimate that out of every million users, 4,700 sets of login details are lost to criminals each year. Over a 3 month period, each financial institution was targeted by 16 phishing websites each week.

Early phishing emails were laughably poor in their execution with obvious spelling errors and barely credible email addresses and yet still people fell for them. Nowadays, they have grown in sophistication and in many cases are very difficult to distinguish from the real McCoy.

It's going to take a combination of technology and education for banks to tackle this threat. Only one of the financial institutions with which I hold an account has established a protocol and explained it to me so that I can recognise a genuine email and none of them have adopted digital signing of emails.

Until action is taken, there's going to be a lot of cost and upset customers for banks to deal with.

 

TagsSecurityRisk & regulation

Comments: (3)

A Finextra member | 12 September, 2012, 13:43

I can report the following: receive email alert from bank indicating over-spend (a threshold spend exceeded).  I view online banking to see that there is no sign of transactions there.  I get curious (panic).  I think it is a phishing attempt.  Call bank.  Incur time and cost.  Turns out the transactions are 'pending' and not visible to me online yet, but I still get alerted with an email (which only showed the last small txn, not the large one causing the alert before it). 

So all in order, but damn confusing.  First time I reported it as suspected phishing (heard nothing).  Second time I called.  Third time... maybe I will have learnt the deficiency.

To your point(s) - I cannot tell a real alert from a phishing one!

Melvin Haskins - Haston International Limited - | 13 September, 2012, 08:55

In ten years of using internet banking I have never, ever, received a phishing attempt addressed to me by name - they are always dear customer. My bank sends e-mail addressed to me by name and also provides my postcode.

I'm quite happy with my bank security. If people are foolish enough to respond to e-mails that are not addressed to them, then they have to face the consequences.

Ketharaman Swaminathan - GTM360 Marketing Solutions - Pune | 13 September, 2012, 16:27

Like I'd pointed out here over a year ago, even non-gullible and technically savvy people would find it difficult to distinguish between a URL like easteroffers.mybank.com (which belongs to my bank and is therefore genuine) and another one like mybank.easteroffers.com (which does not belong to my bank and is quite likely fraudulent). So, refraining from clicking a hyperlink on an URL and instead copying and pasting the URL on the browser's address bar is not so foolproof either. IMHO, people are not as gullible as phishers are savvy. Some banks send emails to me with my name, others don't. The only foolproof counterstrategy against phishing that I could think of was for the bank to authenticate its website to the customer by displaying a preselected image at logon. I know a few banks who do it. Others should, too.

Comment on this story (membership required)
Log in to receive notifications when someone posts a comment

Latest posts from Martin

Innovation and Insight in Financial Services

07 April 2014  |  1828 views  |  0  |  Recommends 0 TagsMobile & onlineInnovationGroupInnovation in Financial Services

Stand and Deliver

26 March 2013  |  2474 views  |  1  |  Recommends 0 TagsRisk & regulationRetail bankingGroupTransaction Banking

Loyalty is an outdated concept

30 January 2013  |  4030 views  |  2  |  Recommends 0 TagsSibosRetail bankingGroupInnovation in Financial Services

Up in smoke

18 December 2012  |  3570 views  |  0  |  Recommends 0 TagsMobile & onlinePaymentsGroupBanking Architecture

Are people really that gullible?

11 September 2012  |  4938 views  |  3  |  Recommends 0 TagsSecurityRisk & regulationGroupOnline Banking
name

Martin Bailey

job title

Technology Product Director

company name

Temenos

member since

2011

location

Hemel Hempstead

Summary profile See full profile »
Temenos products make banks more profitable. My job in running Enterprise Technology is to make s...

Martin's expertise

What Martin reads
My personal blog

Who is commenting on Martin's posts