Phaux Phish

The Malevolent Design webloghas a post about how online financial businesses like to shoot themselves in the foot with customer education. Perhaps the only real defense (short of costly two token authentication) we have against Phishing and online identity theft is to get people to recognize fraudulent websites and emails. But the phishers are clever, sometimes more clever than the actual companies. From Malevolent Design:

For example, TalkTalk lets you register online to manage your account via their site. Instead of simply emailing you to let you know when a new account statement is available, they send out the whole thing as an attached HTML file, complete with your name, address, phone number and account number. OK, that's not much more than what Amazon includes in a dispatch notification, but what makes it amusing/disturbing is the first line of the email:

"Your latest bill is now available to view online. Don't worry it's from TalkTalk."

Compare with, for instance, these Chase phishing mails, many of which seem pretty plausible, or at least more plausible than "Don't worry..." Really, if the fraudsters are doing your identity and branding better than you, you need to be spanked by Marketing.

Photo: Thanks, Peyri