Phishing in people's accounts

Phishing and phishers may be keeping banks on high alert but the law is lagging far behind. Cyber Law expert,  Pawan Duggal explains, 'Phishing is not an offence that is specifically defined under the IT Act, 2000. The law enforcement authorities are keen if at all to report and register a case under the typical generic provisions of cheating and criminal breach of trust under the Indian Penal Code, IPC.'

One of the bigest problems when you encounter phishing is that of cyber jurisdiction. Since these attacks are launched from any part of the world with the victim in a separate country, prosecutions of such cases becomes even more difficult.

Duggal says, 'One of the biggest problems in phishing is how do you go ahead and arrest these kind of offenders. If you look at the law book, it gives you an academic answer. The IT Act, 2000 has extra-territorial jurisdiction and it applies to any person of any nationality anywhere in the world - so long as the impacted computer is physically located in India. But having said that, the reality is that the Indian law is still not applicable to people outside the territorial boundaries. Therefore, the law enforcement agencies reach a dead end.'

With the loopholes in the law, the best way to keep your money safe is to protect yourself from such attacks. Here's how to do that:  

• Be on the alert when a banking e-mail uses dramatic information to get you to react immediately.
• Beware of e-mails from shopping websites offering free goods. It might be a scam to get your banking details.
• Phishing e-mails are not personalized. Your bank will generally use your name when they contact you.
• Finally, clicking on phishing sites may install a spying device on your computer. Downloading an anti-spyware programme will help.

Buch adds, 'We believe that working together with an alert set of customers and with banks who take very rapid action is the perfect antidote. With the authorities coming in and catching and penalizing the offenders, this combination is very rapidly going to make it not worthwhile for a fraudster to even attempt it.'

India is at tenth place when it comes to hosting phishing sites with the US and China biting the phishing bait more often. The United States remains at the top with 28.78% of all phishing sites located out of the United States and 11.96% out of China. Korea, Germany, Australia, Canada, Japan, United Kingdom, Italy and India are the other countries where phishing attacks are prevalent. As of now, 2.11% of the phishing sites are located in India.

Singh says, 'India on the threshold of having more and more people getting into online banking or taking online peronal loans. So, it won't be a surpirzse if someday someone tells me that out of the total size of frauds happening - India would be at 1% or 2% - but even that would be Rs 200 crore."

Though Buch says, If you look internationally at any of the large 3-4 banks in the world, they would be experiencing one phishing attempt a day. We are nowhere near that number.'

But even as banks are gearing up to tackle phishing, there is another kind of threat emerging - phishers are trying to get account details over the phone and this is called wishing. Singh explains, 'Instead of phishing, it's something called 'wishing', where they are using VoIP. Banks are telling people not to click on links. Now e-mails are coming saying that call us on this number for some particular reason and when people dial that number, actually it's not going to the interactive voice response or IVR of the bank, it's going to some other IVR, which mimicks the IVR of the bank and you are asked your credit card details or some other details. So, new ways will keep coming up."

 

Mehak Kasbekar