Phear Of Phishing Doesn't Just Hit The Bankers

Beware The Fear. The blizzard of coverage about phishing (usually involving some awful pun) has done a lot to raise awareness about the problem, but is it enough?

A survey by Insight Express for Symantec of 300 people (no URL available yet, sorry) shows that while three quarters of folk are aware of spyware only a quarter of them have heard of phishing. This cloud of ignorance creates confusion and fear: 44.2 percent of respondents thought they had visited a fraudulent Web site but were not sure. 19.3 percent said they had definitely visited a fraudulent Web site. A little over half are somewhat concerned about online fraud, while 42 percent are 'very concerned'. In other words, nearly everyone is worried.

This fear is already having an impact. Three quarters of folk will now only purchase purchase products through secure sites. That's encouraging -- and not bad for business -- but the following figures are: nearly half will not now provide confidential data over the Internet while nearly a third won't use the Internet for online banking. About 15% said they don't trust the Internet.

This fear and distrust is not going to go away. More than half of respondents felt they knew how to protect themselves from online fraud and/or online identity theft, while a bit under half didn't think they knew how to protect themselves. Taken with my own unscientific dabbling and MailFrontier's recent survey which found that 28% of American adults "inaccurately identify phishing emails", I'd say we have a problem. Or in fact several.

First off, many of those people who think they know how to protect themselves are easy prey. They are going to continue to be duped as phishing attacks grow more sophisticated. That's going to keep the problem going, in part because of weak or misleading 'solutions' such as browser tools and software that supposedly 'identifies' fraudulent emails or links. These tools only raise people's comfort levels and lower their guard.

The broader problem is this: As the number of victims rises, the number of people not giving confidential data over the Internet, not using Internet banking, and 'not trusting the Internet', is going to rise. This is already hurting retailers who have found major cost savings by shifting business over to the Internet. A piece yesterday by The Register's John Leyden quotes a recent survey by LogicaCMG as saying that one in five British users would "hesitate about booking trips online because of mistrust of the ability of travel companies to keep their financial and personal details secure". Given it costs a travel agent 40 times more to take a booking by phone than online, this is hitting their bottom line hard. This will only get worse as more victims succumb, and phishing attacks are no longer one of the bad things that happen to other people.

Then there's the banks. It's been suggested to me that banks don't really care about whether people use Internet banking, since if people start going back to their branches to do their business banks will make their money anyway. But, while appealing, that conspiracy theory fails to take into account the link between online commerce and online banking. If people don't trust the Internet to do banking, it's very unlikely they'll buy something online. That will hit credit card business hard, a mainstay of retail banks. Like it or not, the fate of banks is inextricably tied to the fate of online retailing. So banks don't have much choice.

Bottom line: The future of online commerce is not just about whether it's viable for retailers to do some of their business online. For many retailers it is their business, or at least it's the difference between being profitable or not. Phishing is not just an attack on banking and financial sites. It's an attack on the future of online commerce, which, believe it or not, is still vulnerable because it relies on trust. And trust is not just about reassuring customers, or launching vague 'education campaigns' to give people a vague idea about whether they're safe, and what to do to make themselves safer. It's about making transactions secure, policing website registries for fraudulent domains, working together for a better way to communicate between retailer/bank and customer. All of these things, a year after phishing took off, haven't been done. Hence The Fear.