|
First of two parts
IT is
fascinating how the Internet, as the network of networks,
has revolutionized communication and sped up data exchange
and transmission around the world.
However,
alongside these interesting characteristics are threats it
poses in the lives of either ordinary or sophisticated
Internet users—from losing personal identity to dropping
off billions of money.
In 2007
McAfee chief executive David DeWalt estimated cybercrime
to be a $105-billion market, expecting the numbers to
increase as the complexities of online crimes on the
information highway intensify.
Web
surfers should be educated on how attacks are staged to
safeguard every Net surfer’s privacy and prevent future
devastating scenarios, he stressed.
Ripped-off
identity
The most
preferred illegal activity by identity thieves is the
fraudulent use of somebody else’s personal information.
They steal
names, social-security numbers, credit-card numbers and
passport information to obtain good credit standing and
have goods and services delivered to their doorsteps at
other’s expense.
In other
forms, some illegal immigrants will use other’s people’s
social-security numbers and birth dates to gain employment
and acquire a birth certificate.
Symantec
Philippines country sales manager Al Ramon de la Cruz says
identity theft may be committed through different methods
but are not limited to the Internet, electronic mail,
snail mail and phone.
“Identity
theft is a two-step process. First, someone steals the
user’s personal information. Next, they use that
information to impersonate and commit fraud,” explains de
la Cruz.
Small-scale identity theft is attributed to phishing. Mass
e-mails are sent by phishers containing messages that
evoke emotional responses like fear and excitement.
“Those
e-mails appear to come from a legitimate company, and
usually a request for sensitive information is made. The
Web page like the e-mail appears authentic and, in some
instances, the URL [uniform resource locator] is masked so
the web address will look real and mislead people into
divulging confidential information,” says de la Cruz.
He
continues: “Phishers are also beginning to use viruses to
do their dirty work. These viruses monitor users’ Internet
activities, and will spring into action when they visit a
particular site, either diverting them to an impostor site
or capturing their keystrokes. Without virus protection,
they have no idea that a malicious code resides in their
hard drive.”
In 2006
Metropolitan Bank and Trust Co. (Metrobank), the largest
bank in the Philippines, was a victim of apparent phishing
when a fake web site with exactly the same interface of
the genuine one was created.
Metrobank
quickly assured its clients that it has blocked the access
to the sham site to protect its subscribers and depositors
from being victimized.
If
phishing aims to defraud ordinary users one at a time, its
“cousin” pharming is directed at the financial information
of large groups of people. In this type of fraud, tech
felons hijack a web site’s domain name or URL and
redirects users to a fake web site where fraudulent
requests for information are made.
Webopedia
notes that pharming poisons a domain name system (DNS)
server by infusing false information into the DNS server,
resulting in a user’s request to be redirected elsewhere.
The browser, however, will show the correct web site,
which makes pharming serious and difficult to detect.
Pharmers,
says de la Cruz, rely upon the same bogus web sites and
theft of confidential information to perpetrate online
scams, but are more difficult to detect in many ways
because they are not reliant upon the victim accepting a
“bait” message.
Another
polished method of stealing information is vishing, or
voice phishing. It is the use of telephone or voiceover
Internet protocol to convince people to surrender private
information.
A cammer
pretends to be a representative of a legitimate company
and calls people to update their personal information “to
improve their database.” Some vishers send mass e-mail
messages stating that an urgent account problem has
occurred and warns the holder that the account will be
deactivated if an immediate update is not performed on the
given link.
“With
consumers becoming wise to online phishing, thieves are
now exploiting new Internet-based phone services,” says de
la Cruz, referring to thieves using automated phone
messages to notify consumers of “account problems” and
then requiring them to call a toll-free number supposedly
to resolve the problem. Upon calling the given number,
victims will hear sounds like that of a legitimate
automated phone message and end up divulging classified
information.
Credit
fraud rising
While
credit fraud has been a world phenomenon for years
afflicting many countries, the ever-growing popularity of
credit cards in the Philippines, from 2.5 million holders
in 1997 to about 5.5 million holders in 2007, has also
attracted the attention of fraudsters.
Credit
fraud, in most cases, involves skimming. This process most
commonly occurs in restaurants or gasoline stations when
the customer hands the credit card to an attendant or
waiter who would also be in on the fraud. The scammers
will quickly copy the details, return the card to the
owner and, at the end of the day, sell it to the
fraudsters.
Although
credit-fraud cases are not as widespread in the
Philippines compared with its close neighbors—
constituting less than 1 percent of credit-card
transactions—it still costs the industry a staggering
amount of money.
There are
also other consequences to ongoing credit fraud, such as
loss of investor confidence in the country. The Credit
Card Association of the Philippines has appealed to
Malacañang to give more teeth to its laws against
fraudsters using illegally obtained information from
credit cards, obtained mostly through store or restaurant
personnel.
Online
shopping
To sell
products the fastest time and buy goods at cheaper than
their usual price: these are the two different goals of
sellers and shoppers in visiting local and international
auction sites.
With a
wide array of product categories available on such sites,
many are lured to visit and scan its pages for “hot
deals.” As this may suggest ease and convenience, the
risks nudge especially to buyers are numerous and at times
financially unredeemable.
In the
scams and spams forum index of sulit.com.ph, a local
auction site, ManilaIce discussed how a seller of tech
gadgets allegedly from Romania duped buyers.
ManilaIce
opted to buy a Sony Ericsson P800 in 2003 for $200. The
seller asked the author to send money through Western
Union (WU).
“I
[thought then I] won’t give him the MTCN [Money Transfer
Control Number] unless I receive the package. I was
thinking that it sounds fair to me. If the seller would
try to scam me, I could easily get my money back from WU
and I would only be charged for the fees,” noted ManilaIce.
After
conditions were set, ManilaIce sent more than P12,000 to
also shoulder the shipping fees. The seller told ManilaIce
to wait for three hours to confirm if the funds were sent.
A day passed, no mobile handset was delivered and no more
connections were possible with the seller.
ManilaIce
decided to withdraw the money from WU, only to be
confronted with a mind-blowing revelation. “The seller
withdrew the money around three hours after I sent it. How
could that happen? I never gave him the MTCN. I asked for
the manager and filed a complaint about what happened,”
said ManilaIce.
ManilaIce
continued, “I was disappointed because I was just given
the runaround. They could not do anything because their
system clearly says that the recipient withdrew the money.
Crap, I just wasted more than a thousand on money sending
fees for nothing.”
Later, the
author figured out two things how the seller was able to
take out the funds. “Either the seller hacked WU so he
could get the MTCN from them or has a friend or relative
who works there wherein he could get the MTCN,” thought
ManilaIce.
Transaction trouble in money transfers is one of the major
concerns faced by Filipino online shoppers when buying
goods. This is why most buyers prefer cash on delivery and
bank-to-bank transactions only as payment methods when
buying products.
Leading
online shopping site eBay wishes to remedy the concern
through the introduction of PayPal, an online payment
transfer through the use of credit card, in the
Philippines.
Dan Neary,
eBay Inc. vice president for emerging markets, says buyers
are more protected with PayPal if they send the money and
do not receive the goods—or receive the goods but not
exactly the ones that were posted.
“If a
fraudulent transaction exists, we take the money from the
PayPal account and we give it back to the buyer,” explains
Neary.
The
intention is good; however, eBay members who have PayPal
accounts in the Philippines along with countries such as
Malaysia, India and Indonesia are currently unable to
complete withdrawals through their Visa credit, debit or
prepaid cards because of exchange-rate issues and
policies.
Neary
assured the public, though, that they are now working for
its resolution with financial institutions like Bangko
Sentral ng Pilipinas.
Pop-ups
Likewise,
Internet surfers may suffer from the simple perils of
pop-up advertisements or unexpected balloon messages
enticing them to claim huge winnings, avail themselves of
discounted vacation packages or software services to
counter an existing system error.
Symantec
describes such programs as misleading applications. Some
people, on the other hand, regard it as “Rogue AntiSpyware”
or “SMITFraud.”
De la Cruz
explains, “These programs typically sneak onto their
victims’ systems while they surf the Web, masquerade as a
normal Microsoft Windows alert, or otherwise trick people
into downloading them onto their computer. Once installed,
misleading applications exaggerate or make false claims
about the security status or performance of the user’s
system, then promise to solve bogus problems if the user
pays.”
Not all
advertisements shown in legitimate sites, says de la Cruz,
are legal. Some are just sneaking to high-traffic sites in
the form of banner advertisements at the top of Web pages.
“When a
person is lured to click the ads, a small program called a
‘Downloader’ is installed by the attacker through an
unpatched flaw in the person’s Web browser. This is often
known as a ‘drive-by’ install,” says de la Cruz.
Crimeware
in the form of bots, Trojan horses and spyware are
applications used to trick people into giving out their
personal information.
When a bot
is secretly installed in a computer, de la Cruz says it
allows an unauthorized user to remotely control the system
without the original owner’s knowledge, in order to assist
identity thieves of the blackmarket—where personal
information is sold.
To be concluded on Thursday ... |
