Saudi banks see fewer phishing attacks
Published: May 4, 2011 13:59 Updated: May 4, 2011 13:59
Time to give credit where credit is due. The Saudi banks and the Saudi Arabian Monetary Agency (SAMA) are doing a splendid job fighting phishing. Research released in Dubai last week by Saudi network security company IT Matrix, in partnership with MarkMonitor, a specialist in global enterprise brand protection, shows that in the first quarter of 2011, the company detected just seven phishing attacks against the Saudi banks. This is down from 58 phishing attacks over the course of 2010, when there were about 15 per quarter.
In phishing scams, criminals try to get personal information such as usernames, passwords and credit and debit card information using some type of electronic communication. Phishing used to be confined to e-mail messages linked to fraudulent websites, but now phishing commonly takes place through social networking or compromised websites.
To fight phishing, in recent years SAMA has issued directives targeting all aspects of phishing activity. Massive awareness campaigns began last year and have continued. These campaigns educate users through a variety of channels, including conventional media, automated teller machines, bank websites and SMS messages about the importance of protecting personal financial information and not responding to phishing messages. Saudi banks have now implemented two-factor authentication to access online banking services and all are shifting to "smart" credit cards which require the use of personal identification numbers instead of signatures. Attacking the criminals proactively, almost all Saudi banks use the services of IT Matrix and MarkMonitor to halt phishing attacks before they start.
The world of online crime is divided into specialists. Criminals create and sell small pieces of a larger criminal activity. One group might be responsible for making available the hosting services that host fraudulent websites. Another group might lease the networks of computers or botnets that send out phishing messages. Still others will develop phishing kits which anyone could use to actually create and carry out phishing attacks. MarkMonitor has a global network of specialists who investigate the individual aspects of phishing as they relate to their clients. They work to stop criminal activity at any point in the process, usually by denying criminals the electronic pathways and hosts to distribute their fraudulent communications and collect funds and information. MarkMonitor's Chief Security Officer Ihab Shraim emphasized that Mark Monitor is not a law enforcement agency and can't go after criminals to recover their ill gotten gains. This means that to be effective in protecting their clients, MarkMonitor must prevent criminals from capitalizing on their illegal intentions.
Not every country in the GCC is doing as well as Saudi Arabia in reducing phishing attacks against local financial institutions and data from IT Matrix reveled this. The security firm maintains a research network of e-mail addresses, commonly called spam honeypots, and also collaborates with ISPs throughout the Middle East. By sorting through all the phishing e-mails that were received at the spam honeypots and analyzing ISP data, IT Matrix found that in the first quarter of 2011, Bahrain had 14 phishing attacks and there were 420 phishing attacks against financial institutions in the UAE. The phishing situation is so dire in the UAE that one bank sends warning messages by SMS nearly every day to their customers alerting them to phishing attacks.
So let's give a round of applause to SAMA and the Saudi banks for a job well done in combating online crime. But don't get complacent. The attacks are becoming more sophisticated and the rise in mobile computing has given the criminals new ways to access sensitive data. This is one fight that won't be ending any time soon.
