How dumb do phishers think we are?

Stephen Withers
Monday, 04 February 2008 09:11

Opinion and Analysis

Some phishing attempts can look quite authentic, apart from the fact that the apparent source doesn't actually send such messages to its customers. But others fall well short of the mark.

Someone writing in what is other than their first language may use sentence structures and other phrasing that just doesn't ring true to a native speaker.

While we all make spelling and grammatical mistakes from time to time, major companies generally go to a lot of trouble to maintain their images, so an email that doesn't seem quite right probably isn't. Even if an early version of the copy was drafted by someone with limited language skills, you can bet on it being edited by people who are completely fluent in the local language.

But this afternoon I received a message that anyone with one eye open should have been able to detect as a fake.

The linguistic shortcomings and certain other features marked this as a probable phishing attempt. I'm not going to go into the details because I don't want to give the bad guys any free assistance. But here's what clinched it: a hyperlink referenced a bank other than the one that supposedly sent the email.

I'm not talking about the URL that the link pointed to - the mistake was in the text that appeared in the message!

Yes, an email purportedly from bank "C" actually asked me to go to the web site of bank "W".

To borrow the catchphrase of a fictitious grumpy old man, "I don't believe it!"

I know spammers and phishers prey on ignorance and lack of care and attention, but expecting us to overlook such a gross error seems like a collective insult.