Tweet
Earlier this week, the Financial Services Authority emailed people who had savings in the collapsed Icesave bank. I wondered two things: first, would the email begin, "Kindest Sir, I have in my possession £4 billion that was seized as terrorist monies in an account in your name ready for transmission to you if you will kindly remit your details, I am grateful your reply". And secondly, since this email would presumably be identical, and go out to hundreds, even thousands, of people at the same time, how many spam filters would reckon that this was just a standard "Nigerian 419" advance-fee fraud, and consign it to oblivion?
Even if it was written in something more closely approaching English (personally, I think there should be a new classification of "419 English" for those emails, which contain such neo-Shakespearean constructions as "I must confess my agitation is real, and my words is my bond, in this proposal") then there has to be a high chance that any spam filter would flag it as phishing. Especially if it has a URL in it, and even if that URL goes to the FSA's website.
That's the problem that phishing and 419 scammers pose for our financial institutions: while the latter thought they were covering themselves in glory by cooking up fabulous financial instruments (such as a mortgage-bundling bond that paid only about 2% above ultra-safe US Treasury bonds, but would go fabulously sour if only 6% of the mortgages went sour - pretty much a given in the US in 2006, the 419ers and scammers got on with conquering our email inboxes.
They've done this so successfully that I now assume any email purporting to come from a financial institution that makes it past my spam filters is, even so, junk. Thus I was very suspicious of the email saying "Welcome to online banking" from one bank where I had an account, even though I'd just signed up to do, yes, online banking.
Equally interesting is that this doesn't apply to any of the other big always-online organisations that handle your money. EBay and PayPal always address you by your username, which no spammer will have access to; that's how you can tell phishing emails relating to those two from the real ones. (It's odd Amazon hasn't cottoned on to this key element of identity, yet phishing attacks involving Amazon are comparatively rare.)
How did the financial services companies get into this mess, where the machines that run our online world don't trust their communications? Because they took too long to do it. While they built secure websites, the criminals worked on insecure emails.
But actually, the banks were right to hold back. Email as presently constituted is insecure and so prone to spoofing that a 10-year-old can do it. If - and it's a huge if - we had had S/MIME or PGP implemented everywhere by default from the outset of the net's arrival in the wider world, then we'd be used to the idea of checking an email's encryption certificate against its signature - even getting it done automatically - and rejecting the fakes. Sadly, we didn't. Had Outlook Express used its inbuilt S/MIME functionality as a default, we wouldn't see so much online scamming (which is Microsoft's other giant failure on the web, the first being releasing insecure versions of Windows for online use that hackers could conquer).
I wonder, though, if the FSA is going to realise how many of its emails are probably sitting unnoticed, while people who lost huge sums fume at "government inaction". I must confess, my agitation is real.
guardian.co.uk © Guardian News & Media Limited 2008 | Use of this content is subject to our Terms & Conditions | More Feeds
More...
