Banking Law

The American Banker (paid subscription required) reported last month that notwithstanding banks' efforts to thwart "phishing," more bank customers are falling for phishing schemes.

The number of people who said they lost money as a result of a phishing scam rose 43% from a year earlier, to 3.3% of survey respondents, according to the report, which was published Friday. The Stamford, Conn., market research company conducted an online survey of 5,000 U.S. adults in August.

?Attacks are more targeted,? said Avivah Litan, a vice president and research director at Gartner who wrote the report. ?So it?s less obvious it?s a phishing attack.?

Modern phishing e-mails often use personal information, such as the name of a friend or employer, to better deceive their recipients.

[...]

Although the number of victims is rising, the amount of money they are losing is declining, due in large part to banks? efforts to detect scammers earlier, Ms. Litan said.

The average loss victims reported dropped 29%, to $866 in 2007 from the prior year, Ms. Litan?s survey found.

?Banks and other companies have put limits on how much you can transfer without raising a red flag,? she said. ?There are tighter controls out there ? it?s harder to get money out.?

But that is no reason to claim victory over the phishers, Ms. Litan said. ?We haven?t made a dent in fighting phishing at all.?

Phishers are also favoring the theft of debit card numbers over credit card numbers because it is easier to get cash with debit cards, she said.

One of the most troubling trends she has noticed is the use of online advertising as a distribution tool for malicious software, she said. This could prove extremely disruptive for e-commerce if it leads consumers to stop trusting online ads.

It appears that those "red flags" and background monitoring procedures are paying off, at least in terms of limiting the size of losses. On the other hand, until more bank customers stop falling for phishing schemes, the crooks will continue to use them.

Unfortunately, a new variation of this scheme recently popped up. According to an FBI alert, it's called "vishing."

Are you one of many who have received an e-mail, text message, or telephone call, purportedly from your credit card/debit card company directing you to contact a telephone number to re-activate your card due to a security issue? The IC3 has received multiple reports on different variations of this scheme known as "vishing". These attacks against US financial institutions and consumers continue to rise at an alarming rate.

Vishing operates like phishing by persuading consumers to divulge their Personally Identifiable Information (PII), claiming their account was suspended, deactivated, or terminated. Recipients are directed to contact their bank via telephone number provided in the e-mail or by an automated recording. Upon calling the telephone number, the recipient is greeted with "Welcome to the bank of ..." and then requested to enter their card number in order to resolve a pending security issue.

For authenticity, some fraudulent e-mails claim the bank would never contact customers to obtain the PII by any means, including e-mail, mail, and instant messenger. These e-mails further warn recipients not to provide sensitive information when requested in an e-mail and not to click on embedded links, claiming they could contain "malicious software aimed at capturing login credentials."

Please beware; spam e-mails may actually contain malicious code (malware) which can harm your computer. Do not open any unsolicited e-mail and do not click on any links provided.

A new version recently reported involved the sending of text messages to cell phones claiming the recipient's on-line bank account has expired. The message instructs the recipient to renew their on-line bank account by using the link provided.

Due to rapidly evolving criminal methodologies, it is impossible to include every scenario. Therefore, be cognizant and protect your PII. Beware of e-mails, telephone calls, or text messages requesting your PII.

If you have a question concerning your account or credit/debit card, you should contact your bank using a telephone number obtained independently such as; from your statement, a telephone book, or another independent means.

And remember this simple rhyme, kids: if anyone lays a hand on your PII, stick your finger in his eye.

In the world of bricks and mortar crime fighting, the old "No Hats, No Hoods, No Problem" fad (actually called "No Hats, No Hoods, No Sunglasses," but we prefer to modify the lyrics so that we can sing them to the Kenny Cheseny tune "No Shirt, No Shoes, No Problems") is catching on, coupled with the FBI-promoted "meet and greet." At least, it's catching on in the Sunshine State.

Florida banks are being asked to ban patrons from wearing hats, sunglasses or hoods to curb holdups.

The Florida Bankers Association, in cooperation with the FBI, the Florida Department of Law Enforcement, the Florida Highway Patrol and Fraud-Net, announced a new program that strongly encourages patrons to remove hats, hoods and sunglasses when they enter Florida banks.

The program, dubbed "No Hats, No Hoods, No Sunglasses," stops short of denying service to clients wearing the offending clothing or accessories. Bank personnel will direct those who refuse to remove hoods, hats or sunglasses to areas of the bank with more experienced tellers and heightened security.

"Heightened security" being code words for "patrolled by a Rottweiler named 'He-Eat-Me' and an Iranian Imam whose issued a fatwa against Hoodies and who carries an AK-47 he calls 'The Hater of Hats.' "