The Pacific Internet Society (PICISOC) is concerned with what it believes is the lack of awareness in the Pacific region of an Internet-related fraud called “identity theft”.
This has prompted the non-profit interest group to post an advisory on its website warning computer users of the dangers they face, even from the most simple tool like an email.
“Identity theft on the Internet is when someone will steal your virtual identity to access your information online,” it said. “That can be done inorder to access your mail, your social networks or your bank account.”
One way in which the theft of one’s identity is carried out is by a method called “phishing,” where online fraudsters trick users into revealing important information like full name, address, even bank accounts and PINs (personal identification numbers).
These information are later used against the victims.
“In addition to looking out for viruses and other dangerous software which arrive via email attachments, computer users in the Pacific region need to be aware of an increasingly common method of identity theft known as phishing,” said PICISOC spokesperson Franck Martin.
“A typical scenario of phishing starts when someone receives an email, apparently from reputable sources like a bank or online shopping site, asking them to visit a website.
The website is designed to look just like the company’s official site but is located on a computer controlled by criminals,” Martin said.
“Typically, the site states that something has happened involving the person’s money or personal information, and asks them to confirm. If this person doesn’t realise that they are not on the true website, they might submit sensitive information such as their password, bank account or credit card number.
Criminals can then get access to this person’s money and steal it.”
Martin believes there is a low level of awareness that such a crime can happen here in the Pacific. Despite statistical evidence that Internet usage has grown exponentially in the Pacific over the last eight years, general knowledge regarding Internet-related crimes, including legislations that support the prosecution of perpetrators, are generally lacking.
According to http://www.internetworldstats.com, Oceania (excluding Australia and New Zealand) had around 488,000 Internet users by June this year while a number of Pacific island countries had experienced close to or over 1000 percent growth in Internet users between 2000 and 2008. Yet, this growth, PICISOC believes, is hardly reflected in what consumers and lawmakers know about the dangers associated with this new medium of communication.
“It (awareness) is still pretty low, as most enforcing agencies and legal agencies are not aware of the issues, let alone have the tools to fight.
Anti-SPAM law is just getting introduced. Unauthorised access to a system is not a crime and there is no such thing as digital evidence,” said Martin.
But in a way, the Pacific had been relatively shielded from crimes such as phishing because, according to Martin, not many services in this part of the world were offered over the Internet.
These days however, a worrying trend noted by PICISOC is the increasing number of emails that claim to be coming from local financial institutions that in reality are trying to wheedle ‘sensitive” information out of unsuspecting recipients.
This has closely followed the trend where local banks were now beginning to offer services via the Internet.
In Fiji for instance, one user said she frequently received emails from the local branches of Westpac and ANZ banks, telling her to log on to a site and update her information online. These banks offer online banking services, making their customers who do Internet banking sure targets for cyber criminals.
The website addresses or “links” supplied in the emails even have the banks’ official names on them, giving the impression that the correspondence really came from the banks.
An unsuspecting user logging on to “update” his or her account would no doubt have to type in the password and PIN, little knowing that he or she has just handed these personal information not to the banks but to crooks.
According to Martin, who has also been a recipient of such an email, a bank would never ask for password or account details by email, hence, consumers should immediately be on high alert when receiving emails of this nature.
“Typically, banks will never even ask you to update those details via email so be very suspicious of any emails that asks you for your passwords or that you update financial details via the web,” Martin said.
In a bid to create awareness, PICISOC is now working on Internet Trust and Identity, where an ad hoc group meets regularly to exchange cyber security information.
So what does one do when receiving such unsolicited emails (sometimes called SPAM) that try to steal ones personal information?
“The best defence in every case is common sense,” said Martin. “If you don’t recognise the person requesting the information, find a way to independently verify their identity first. If someone offers you free credit or a prize, be suspicious. As the saying goes, there’s no such thing as a free lunch.”
The extent of Internet crimes—one of which is phishing—in the Pacific is still not clear but in the more developed economies, the “underground cyber-economy” as it is called, is not just a thriving business, it is also very well organised one where the key commodity is information.
In a report by US security firm Symantec Corp. titled “The Underground Economy” and published in November, Symantec estimated that “the value of total advertised goods on underground economy servers was over US$276 million between July 1, 2007 and June 30, 2008.”
If you’re wondering what these “advertised goods” are, Symantec refers to them as “credit card data, bank account credentials, email accounts and just about any other information that can be exploited for profits.”
In the underground cyber-economy, these information are bought and sold just like fish and taro on a Saturday at the local market.
