Phishing against banks hits all time high

Phishing attacks targeting financial services firms reached an all-time high in December, the Anti-Phishing Working Group (APWG) has revealed.

According to APWG's monitoring some 85 per cent of all reported phishing incidents during the month targeted the financial sector, representing an increase of around 10 per cent on previous levels.

APWG chairman David Jevans said: "No brand is really safe, but it is interesting to note that the concentration on phishing attacks against financial institutions actually increased to a new high during a time when many were concerned that opportunistic phishers would spoof retail sites, using consumers' urgency to keep their e-commerce accounts in order to complete their holiday shopping in time."

The APWG report also suggests that the number of attack targets continues to rise, running from 44 in October to 51 in November and 55 in December.

"The concurrent proliferation of targeted brands and concentration of phishing focus on financial institutions is, of course, disturbing," warned Jevans.

"While not quite yet definable as a trend, the survey suggests movements in the fragmentation of brand targets that we will be asking our analysts to interrogate in greater depth in future reports."

The report, which was jointly written by analysts from Websense Security Labs and Tumbleweed Communications for APWG, shows the "relentless increase" in phishing attacks that have been apparent all through 2004.

Highlights of the study include:

• Number of active phishing sites reported in December: 1,707
• Average monthly growth rate in phishing sites July through December: 24 per cent
• Number of brands hijacked by phishing campaigns in December: 55
• Country hosting the most phishing websites in December: US
• Scams containing some form of target name in URL: 24 per cent
• Scams containing no hostname, just IP address: 63 per cent
• Average time online for site: 5.9 days
• Longest time online for site: 30 days