RSS Alerts

Related Links

Related Stories

  • Webroot reports tax return malware-infecting email scam reaching the UK
    Webroot, the internet security software specialist, reports that an Internal Revenue Service (IRS) tax email scam - in which US internet users have been emailed a malware-infected warning about under-stating their income or underpaying of tax - has arrived in the UK.
  • HMRC phishing attacks offer cash rebate as lure
    Yesterday was the last day in which UK taxpayers could file their 2008/2009 tax returns online – without getting fined for being late – and HMRC reports that tens of thousands of fraudulent phishing emails were sent out last week.
  • Verified by Visa and MasterCard SecureCode security in question
    The 3D Secure method of online card transaction protection – aka Verified by Visa and MasterCard SecureCode – may not be as secure as the banks are telling us, as a team of security researchers claim there are multiple weaknesses.
  • Keeping sensitive information secure when staff is leaving
    Career loyalty is an endangered creature. Unlike our predecessors, today’s workforce is unlikely to stay committed to a job for five years, let alone their entire lives. But with such a fluid stream of employees keeping human resources busy, and countless eyes being cast over company data, Rob Stringer investigates how sensitive information can stay faithful to its organisation, even if its staff don’t...
  • Search for security
    With more than 30 000 web pages being infected every day, search engine results could increasingly lead to malware infection. Kari Larsen asks what the search engines are doing to mitigate security threats, and how users can protect themselves.

News

Webroot reports on fake Verified by Visa phishing scam

20 November 2009

IT security vendor Webroot says that a phishing scam purporting to come from Visa, the international card issuer, is scamming internet users as they start their online shopping for Christmas.

According to a blog posting by Webroot, the phishing scam commences with a phishing email advising the recipient that he or she can now sign up for Verified by Visa, an online authentication system designed to enhance security for online shoppers.

Whilst the Verified by Visa security scheme is legitimate, Webroot noted that the phishing email links to a bogus page that logs your credentials for - presumably - later use by the fraudsters.

"The thing is, you don't have to go to a special web page to sign up for Verified by Visa. You are supposed to be offered the chance to sign up while you're completing your purchase on the participating merchant's web site, as you're entering your billing details", said the blog posting.

"The Visa website spells this out in a simple graphic (though there have been some interesting problems with the way the system works)", it added.

According to Webroot, in the Verified by Visa phishing scam, users are sent to a web page that asks you for the information you gave the card-issuing bank at the time you first signed up for the card.

"That's red flag #1, but it's worth repeating: In a real sign-up form for Verified by Visa, you won't be asked to provide your mother's maiden name, social security number, birthdate, or any other sensitive details that you wouldn't otherwise enter into a web-based order form while shopping online", the blog notes.

The other red flags include the lack of a secure (https) connection and the registration of the domain name used by a Google email account.

 

 

This article is featured in:
Data Loss • Malware and Hardware Security

 

Comment on this article

You must be registered and logged in to leave a comment about this article.

Copyright © 2010
Elsevier Ltd. All rights reserved.
Terms & Conditions | Privacy | Website Design Working with water