Preventing and handling phishing attacks

Abstract

Phishing (also known as carding and spoofing) is the act of attempting to fraudulently acquire sensitive information, such as passwords and credit card details, by masquerading as a trustworthy person or business with a real need for such information in a seemingly official electronic notification or message (most often an email, or an instant message (IM)). It is a form of social engineering attack. Customers of banks throughout the world have been victims of phishing. This paper covers the technologies and security flaws phishers exploit to conduct their attacks, and provides advice on security measures that can be employed by financial service providers such as Banks in order to prevent and handle phishing attacks. The customers’ perspective is also considered.