'Phishing' fraud has costs banks £1m

FRESH 'phishing' emails have been sent out by fraudsters in an attempt to trick online customers of Barclays bank and credit card company MBNA. The latest attack comes a day after the Association of Payment Clearing Services admitted to Radio 4‘s Money Box programme that the fraud, where criminals 'phish' for internet passwords, had so far cost banks more than £1m.

The emails, sent out randomly, asked customers to log-in on a bogus website, in an attempt to steal usernames and passwords.

Barclays, Lloyds TSB, Halifax, Nationwide, Citibank, NatWest and MBNA have all been targeted in the past. The industry promises to reimburse any victims of online fraud.

The scam has evolved over the past year. Early crude attempts asked, often with spelling errors, for passwords to be emailed back. Now customers are directed to sophisticated replica websites where they are asked to log-in. The false sites, reportedly set up by criminal gangs in Eastern Europe, have improved their authenticity by including links to banks' real websites.

Industry figures reveal an explosion in phishing attempts. MessageLabs, a US-based e-security firm, says it logged 279 such scams on the internet last September. By January, the number had leapt to 337,050.

Overall it is impossible to determine how many users have fallen victim to online phishing scams but analysts estimate that up to five percent of fraudulent emails succeed in obtaining financial data.

'For targeted organizations, the impact can be high - including lost productivity, customer confusion and complaints, damage to the brand and legal implications,‘ said Mark Sunner, chief technology officer at MessageLabs. 'For individual users, the financial losses can be excessive. If allowed to continue unchecked, online phishing scams threaten to undermine confidence in e-commerce as a whole.'