Phishing for Mules
We all know, or should know, about phishing, a fraudulent attempt, frequently through legitimate looking e-mail requests, to obtain personal information such as a credit card number, a social security number, or a bank account number and PIN. The following is one that I received the other day.
Warning Notification
It has come to our attention that your Community National Bank account information needs to be updated as part of our continuing commitment to protect your account and to reduce the instance of fraud on our website. If you could please take 5-10 minutes out of your online experience and update your personal records you will not run into any future problems with the online service.
However, failure to update your records will result in account suspension. Please update your records before: Sunday, [October 14, 2007].
Once you have updated your account records, your account activity will not be interrupted and will continue as normal.
Click here to update your account information
As incredible as it sounds, people respond to e-mails like this. A recent
Harvard study found that 90 percent of the phishing recipients don't recognize a well constructed phish. What I found even more surprising was that neither education, age, sex, previous experience, nor hours of computer use showed a statistically significant correlation with vunerability to phishing.
The real problem for the phisher isn't getting the information; it's how to convert ill-gotten information into cold cash. One way is to simply sell the information on the black market where the going price for a credit card number is around $1. That is what apparently happened to some of the 47.5 million plus credit card numbers stolen from TJX several years ago. More information raises the value. A card with a three-digit code brings around $5. while additional security information such as a mother's maiden name can raise the value another $10. A working PIN can drive the price to more than $100.
In any case, at some point the stolen information needs to be translated into cash or merchandise that can be resold. In March of this year a Florida gang was charged with using credit card numbers from the TJX theft to steal $8 million in small transactions at stores in Florida.
The fact that they were caught underscores the phisher's problem. It is hard to make serious money without being noticed--and being caught and sent to jail. (In Florida it was a Wal-Mart clerk in Gainesville who became suspicious of multiple gift-card purchases that led to a review of store surveillance tapes.)
To take full advantage of stolen information, the crook, who is frequently operating from a foreign country, needs "mules." A mule is someone, preferably in the same country as the victim, to handle money transfers or ship items to the phisher. The more tenuous the money trail, the more likely it is that crook can get away with it. I made up the following narrative, but it is based on real events.
Tom was desperate. He and Mary had thought that they we pretty well set. But that was before he lost his job of 23 years when the plant closed and Mary got sick and had to stop working. Now Tom was working three part-time jobs, anything he could get, but without health insurance and mounting medical bills, they were sliding towards financial disaster. That's when he saw an online bulletin board ad for a "shipping manager" to help in product distribution. The job promised a $50 commission per package transfer plus a $2,000 per month base salary. No special skills were required, and it required no financial investment on his part. Best of all he could work from home, which made it easier for him to care for Mary. The prompt response to his query contained a personal information form and an application for employment. The first form requested his name, address, phone number, electronic contact information, and bank account number so that funds could be deposited in his account. The application for employment was standard and included a detailed list of his duties if hired. As merchandise arrived at his home he had to repackage it and ship it to an overseas address. Everything worked great for the first month. Tom spent a couple of hours a day reshipping high-end merchandise from regional stores to an address in Panama. He'd made almost $5,000 dollars and thought that he and Mary had turned the corner financially. Then the police showed up. It seems that the merchandise had been purchased with stolen credit card numbers, and the address in Panama turned out to be nothing more than an abandoned mail drop. When Tom pleaded that he didn't know that the merchandise was purchased illegally, he was told that even though he had nothing to do with the theft from another persons credit card account, he was still breaking the law.A variation on this theme is for mules to receive funds into their accounts and then send the money overseas by wire transfer. The mule receives a commission on each transaction. Ads for these mules might be for a "Financial Operations Manager" responsible for transferring money for young cancer patients in a foreign country.
This is money laundering and is illegal. It also leaves the "mule" holding the bag while the phisher walks. The quote incorrectly attributed to P.T. Barnum, "There's a sucker born every minute," seems to be true.
The
Bank Safe Online organization has developed the following guidelines for recognizing mule solicitations:
- Be wary of any unsolicited offers or opportunities for work, especially if the company is based overseas;
- Verify the details of any company that you are consider dealing with and never give your bank account details to someone you don't know or trust;
- Contact your bank immediately if you think that you may have become involved in a money mule scam;
- If you see an opportunity to make some easy money and the offer seems too good to be true, then it probably is!
It's unlikely that anyone reading this column would be tricked into becoming a mule. We do, however, have a responsibility to make sure that the general community can recognize, and hopefully ignore, these scams. It may be nothing more than counseling friends, but it could include speaking to local schools and community organizations. And since most of us are in education, we have a role in protecting students by not only making them aware of phishing but also explaining how fundamentally honest individuals can be suckered into criminal actions.