Phish phodder: is user education helping or hindering? presented at Virus Bulletin 2007

by Andrew Lee (Eset),


Summary : "Mostly, security professionals can spot a phish a mile off. If they do err, it's usually on the side of caution, when
real organizations fail to observe best practice, and generate phish-like marketing messages. Many sites are now
addressing the problem with phishing quizzes, intended to teach the everyday user to distinguish phish from phowl
(sorry). Academic papers on why people fall for phishing mails and sites are something of a growth industry. Yet
phishing attacks continue to increase, and, while accurate and up-to-date figures for financial loss are hard to come
by, indications are that losses from phishing and other forms of identity theft continue to climb. This paper:
Evaluates current research on how end users are susceptible to phishing attacks and ID theft.
Evaluates a range of web-based educational and informational resources in general and summarizes the pros and
cons of the quiz approach in particular.
Reviews the shared responsibility of phished institutions and phishing mail targets for reducing the impact of
phishing scams. What constitutes best practice for finance-related mail-outs and e-commerce transactions? How far
can we rely on detection technology? What are the responsibilities of employers and ISPs towards staff and
customers? "