Phishers Run Quality Control Tests to Validate Credit Card Details

As per security analysts, since the specific number of users responding to phishing messages by giving fake information is still unclear, phishers are constantly conducting quality assurance checks to ascertain that the gathered data is genuine credit card details.

For example, a new blog posted at Symantec's Security Response blog site examined a phishing page wherein the phisher was running credit card authentication tests prior to receiving anything, a tactic that becomes a commodity item for phishing pages, when phishers were trying to con other phishers.

Phishers are familiar with these methods and constantly striving to achieve perfection in their attacks, which, in turn, increasing their profits. Being a proof of concept method, it is a part of PHP software exposed during a phishing attack, meant to check the credibility of the users' credit card details consistent with card number norms. Subsequently, the phisher will attempt to confirm the card number by applying Luhn's algorithm, said security analysts, as reported by ZDNet on October 30, 2008.

They further added that investigations revealed that only after the validation of the card number and checking of the Luhn algorithm data was delivered. Furthermore, during these phishing drives phishers are able to get the authentication done by sending the submitted information to original Websites; provided the attacked firm is supervising the flow of the incoming traffic correctly.

Meantime, phishers changed their modus operandi in keeping with contemporary trends, said security investigators and experts. Security experts have given an instance of recent phishing drive in which a phishing message that claimed to be from legal registrars Network Solutions Inc. and eNom was sent to users. In fact, the message came from a phony domain name trying to steal users' account details. The eNom phishing message pretended that eNom was carrying on maintenance of the data center and database, whereas the phony Network Solutions email stated that the user had to renew his/her invalid domain registration.

Security experts alleged that with such carefully designed phishing campaigns and technically competent phishers supporting them, there is high possibility that most of them will be enforced.

» SPAMfighter News - 14-11-2008

SPAMfighter is a free spam filter for Outlook, Outlook Express,Windows Mail and Thunderbird - Read more

SPAMfighter Exchange Module is a spam/virus filter for Exchange server - Free 30 days trial

Remove Spyware with SPYWAREfighter - Free 30 days trial