According to new survey from Gartner Research, the number of US adults that are certain — or as least believe — that they have received phishing e-mails has nearly doubled in the past two years.
Approximately 109 million US adults received phishing e-mails in 2006, up from 57 million in 2004.
In addition, not only is volume up, but more to the point, phishing works. Financial losses stemming from phishing attacks rose to more than $2.8 billion in 2006.
The good news, if there is any, is that this year, overall, fewer people say they lost money to phishers. Unfortunately, when they did lose, they lost more. In two years, the average loss per victim grew from $257 to $1,244.
"The average loss per victim nearly quintupled between 2005 and 2006," said Gartner analyst Avivah Litan. "And the thieves seem to be targeting higher-income earners who are also more likely to transact on the Internet."
Money lost to phishing is also staying lost. The average amount of money consumers recovered from phishing attacks in 2005 was 80%, but in 2006, recovery amounts dropped to 54%.
Much of that drop is due to changing tactics on the behalf of phishers. Phishing e-mails are impersonating banks less often, and other brands, such as PayPal and eBay, more.
"Cyber-criminals are starting to shift away from attacking online banks directly, and they are leveraging less conventional brands and/or using hard to detect social engineering methods to reap financial gains," said Ms. Litan. "Countermeasures such as phishing detection and take-down services deployed by banks, Internet service providers (ISPs) and others are obviously not sufficiently widespread or effective."
Of course, phishing would not work if users did not click. But, unfortunately, users are clicking, a lot. According to Gartner, an estimated 24.4 million Americans clicked on phishing e-mails in 2006, up from approximately 11.9 million in 2005.
In addition, 3.5 million users gave sensitive information to the phishers in 2006, up from 1.9 million in 2005.
Everybody may not be phishing. But enough people are to make it a very profitable scam.