Caught a bit of a fraud programme on Radio 4 driving home from mum's yesterday, worth a listen on iSounds. The bit I heard was about my most feared combination, which is fraudsters who've garnered enough personal information from the web to mount a convincing attack. Most spam email and phone calls are low threat because they're sent at random guessing the recipient might have an Amazon parcel on the way, or similar. Coupled with bad English, they're usually easy to spot.
Targetted attacks are more dangerous, and possible because folk see no harm in putting personal information on the web, plus crooks work hard to harvest data from legitimate organisations.
How about getting an email from a grandchild in trouble asking to be urgently sent money, and the request is bulging with correct family detail like nicknames, locations, and personal circumstances?
Or your PC fires up with a message from the 'Microsoft Security Team', who when you ring them, speak perfect reassuring English – probably not a problem sir. However, they 'investigate' without asking for any private information, and 'confirm' in a fluster that your computer is transferring money out a bank account. They cause a panic by identifying the account with your correct name, account number and sort code. Unless you're authorising these transfers, they say, it's malware, and urgent action is needed to save the money, You must log on to your bank and immediately transfer the funds to holding account xx-xx-xx xxxxxxx, whilst they try and stop the virus.
Don't get carried away! Ring up the granddaughter and don't do what they say – report the alleged problem to your Bank. No legitimate organisation ever asks customers to protect money by moving it to another account themselves. If asked to do that, it's a scam. When a bank finds out an account is compromised, they only have to lock the account : there's no need to move money.
Nigel is right about little being done to stop the blighters! By value about half of all crime is Cyber-crime, and the police aren't resourced or organised to deal with it. Only about 1% of Cybercrime is prosecuted, and most isn't investigated. Almost none of the money is recovered.
Given the scale of the problem, I'd expect a lot of policemen to be allocated, and that police forces would have specialists teams investigating. Nope – no money. A further problem is that UK police are set up to deal with crime in their area, and the system is less effective when criminals are located outside the region. Understandable when the criminal is in Timbuctoo and the victim in Plymouth, but worrying when the Devon and Cornwall constabulary can't get West Mercia to move. (And vice-versa) Unfortunately, staying outside a victims police region is easy for criminals on the internet.
What's needed is a well-funded National Police cyber-crime unit, responsible for investigating and prosecuting all UK cyber-crime. The sort of police methods that deal well with a local solicitor defrauding his clients, don't touch the sides of this one. In the UK the problem became serious about 15 years ago, and – so far – the government hasn't gripped it. Reasons – it's expensive and difficult. Instead, the strategy has been to nudge financial institutions into preventing this type of crime. Not very successfully so far judging by the figures.
Who loses after a successful fraud? Either the victim, or – if the bank accepts responsibility, then it's the banks other customers – everybody pays a little more for banking services. Spreading the pain over millions of customers makes it less obvious there's a big problem. However, I dislike the approach because it keeps cyber-crime safe for criminals! And easy ways of making money will always attract large numbers of new recruits, who in this case are allowed to hone their skills without the law intruding.
Be careful out there!
Dave