Australian Broadcasting Corporation


LOCATION: http://www.abc.net.au/7.30/content/2004/s1038996.htm

Broadcast: 05/02/2004

Online bank customers face 'phishing' fraud


KERRY O'BRIEN: While Internet providers and virtually everyone with a PC fret about attacks from computer viruses such as MyDoom, a more surreptitious assault is costing hundreds of millions of dollars.

This week, Australia's third biggest Internet provider, Ozemail, revealed it had been targeted by so-called 'phishing' campaigns and that's phishing with a 'ph '.

It's a term used for particular Internet scams and the one that Ozemail has highlighted involves cyber-thieves using an apparently innocuous, but bogus, email to gain access to a victim's Internet banking details.

It's a compound problem for the banks.

Not only are they losing a lot of money, but it also raises questions about the security of online banking.

Business and economics editor Tim Lester reports.

DAVID BELL, AUSTRALIAN BANKERS ASSOCIATION: The potential for fraud is always very high in any industry.

TIM LESTER: Can the safe crackers of cyberspace really get to our money?

DANIEL ZATZ, SOFTWARE SECURITY CONSULTANT: They're becoming very, very clever in the way they're writing these viruses.

TIM LESTER: It's a pressing question, certainly for the seven million Australians who now bank on the Internet.

ALLAN BELL, ANTI-VIRUS SOFTWARE MARKETER: Online banking has grown threefold in the last three years.

TIM LESTER: But pressing too for the banks and for others who want confidence in e-commerce and see instead some nasty surprises for business online.

DANIEL ZATZ: Oh, it's a huge threat.

TIM LESTER: Daniel Zatz is a Sydney-based security consultant for software giant Computer Associates.

It sells anti-virus software but Daniel Zatz admits no software can stop the so-called phishing threat.

DANIEL ZATZ: If we look at the scams, pretty much every major bank has had one of those email scams against them.

The issue there is that technology in general isn't really going to help them.

TIM LESTER: That's because bank customers are simply sent innocent looking emails that lead them back to ghost websites made to look like the bank's log-on page.

The duped customer types in their user name and password, giving the crooks the Internet keys to their bank account.

ALISTAIR MacGIBBON, HIGH TECH CRIME CENTRE: Well, we first saw the crime around Easter 2003 and since that time we've seen several instances of it and it's affected most of the major banks in Australia.

TIM LESTER: Alistair MacGibbon heads the joint federal-state police high-tech crime centre.

ALISTAIR MacGIBBON: The real life example is akin to someone coming up behind you when you're at the automatic teller machine and tapping you on the shoulder and saying, "Excuse me. Can I borrow your card and give me your PIN number?"

People don't do that in the physical world, but that's essentially what they're being asked to do online.

DAVID BELL: The incidence of online fraud is relatively low compared to overseas jurisdictions. Having said that, of course we're concerned.

TIM LESTER: It's not a topic the major banks want to talk about.

They're trying to attract more customers to Internet banking and that requires public confidence in Internet security.

They also don't want to advertise bank websites as playgrounds for crooks.

So rather than agree to our interview requests, all the big banks referred us to their lobby group.

We then asked the Bankers Association whether it could substantiate a newspaper claim that Internet fraud is costing Australian banks $500 million a year.

DAVID BELL: I don't have any information which would allow me to let you know what that figure would be.

TIM LESTER: Reluctant to talk about the extent of the problem, but the banks have been schooling customers in solutions.

So too are have the high-tech police.

ALISTAIR MacGIBBON: Firstly, don't answer those types of emails.

Secondly, don't ever click on the hyperlinks, but type in the actual address.

And never give out your user name and password.

ALLAN BELL: Identity theft as a whole is the fastest-growing crime in this country.

TIM LESTER: When computer viruses surge, the makers of anti-virus software can ride the publicity.

Allan Bell admits his company's product can't stop people falling for the phishing scam but it can stop a sinister new threat often attached to alluring emails.

ALLAN BELL: Maybe you're expecting a picture of Anna Kournikova or something like that and when you run it, it installs some software in the background.

DANIEL ZATZ: And effectively what it's going to be doing is just logging every single key stroke you make.

TIM LESTER: And sending them back to the hacker that sent it in the first place.

DAVID BELL: What can happen is when you go to your Internet banking account and type in your user ID and your password.

Then the hacker can capture that information.

Ultimately, this is what the hacker receives, is your name and your password and free access to your account.

DAVID BELL: Where the problem is occurring is at the customer, the user ends.

No bank systems have been penetrated.

TIM LESTER: But if the customer hasn't contributed to the fraud, the bank has to stomach the cost of the missing money.

The threat so worried one South African bank it bought 80,000 copies of a major anti-virus package to give to its Internet customers.

ALLAN BELL: I guess they worked out that in the long run that was going to save them more money than it was costing them through the Internet fraud.

TIM LESTER: Allan Bell says Australian banks are at least talking to his company about similar deals.

ALLAN BELL: They are quite interested in the South African model.

TIM LESTER: Software companies talk up the problem.

Banks talk it down.

Wherever the truth lies, Internet security has emerged as a big stoplight to businesses that might otherwise trade online.

JULIE CLEELAND NICHOLLS, 'PACIFIC INTERNET': What we find in a survey that was released by census last year is that some 51 per cent of small to medium-size Australian businesses have said that they will not move into an e-commerce environment while they are still so concerned about security.

TIM LESTER: Asia-Pacific area service provider Pacific Internet has more than 50,000 Australian customers.

One third are businesses.

Marketing manager Julie Cleeland Nicholls says Internet banking is highly attractive to business, but way too many companies baulk at it because they don't trust the security.

JULIE CLEELAND NICHOLLS: The Australian banking and financial industry does need to lift their game and to make sure they are protecting customers as they themselves are moving into more of an e-commerce environment.

ALLAN BELL: Recently we did some consumer focus groups and one of the big messages that came through was people saying to us, "Every time I do online banking, I hold my breath".

TIM LESTER: The banks want us less in their branches, more at their websites, but millions of customers are not convinced.

Each new virus, each tale of fraud, adds doubt, a little brake on the shift to Internet banking.

KERRY O'BRIEN: And guess who the fish are they're trying to hook, you and me.