The list of phishing incidents covers important or noteworthy events in the history of phishing: scams where attackers deceive people into revealing sensitive information or installing malicious software.
1980s 1984 An early phishing incident was documented at the New Jersey Institute of Technology (NJIT). In an article titled "Life in a Wired Society" in Omni magazine, Murray Turoff challenged a 'sandy-haired whiz kid', Bob Michie, to find a vulnerability in NJIT's EIES computer system. The resulting discovery was part of a sanctioned operation and could be considered one of the earliest documented successful phishing attempts. 1987 A phishing technique was described in detail in a paper and presentation delivered to the 1987 International HP Users Group, Interex.
1990s The term "phishing" is said to have been coined by the well known spammer and hacker in the mid-90s, Khan C. Smith. The first recorded mention of the term is found in the hacking tool AOHell (according to its creator), which included a function for attempting to steal the passwords or financial details of America Online users.
1995 Phishing on AOL was a technique used by the warez community, who traded in unlicensed software, and black hat hackers to steal credit card information and commit other online crimes. AOL would suspend the accounts of individuals caught using certain keywords in chat rooms related to counterfeiting software or stolen accounts. The term "phishing" originated from the use of the <>< symbol in chat transcripts as a way to disguise references to illegal activity and evade detection by AOL staff. The symbol resembled a fish, and, combined with the popularity of phreaking, led to the term "phishing." AOHell, a program released in 1995, allowed hackers to impersonate AOL staff and send instant messages to victims asking them to reveal their passwords by claiming to need to "verify your account" or "confirm billing information". AOHell was a custom-written program used for phishing and warezing on AOL. In an effort to combat phishing, AOL added a warning to all instant messages stating that they would never ask for passwords or billing information. However, users with both AOL and non-AOL internet accounts (such as those from an ISP) could still phish AOL members without consequences. In 1995, AOL implemented measures to prevent the use of fake credit card numbers to open accounts, leading to an increase in phishing for legitimate accounts. AOL deactivated accounts involved in phishing, and eventually the warez scene on AOL was shut down, causing most phishers to leave the service.
2000s 2001 The first known direct attempt against a payment system affected E-gold in June 2001, which was followed up by a "post-9/11 id check" shortly after the September 11 attacks on the World Trade Center. 2003 The first known phishing attack against a retail bank was reported by The Banker in September 2003. 2004 It is estimated that between May 2004 and May 2005, approximately 1.2 million computer users in the United States suffered losses caused by phishing, totaling approximately US$929 million. United States businesses lose an estimated US$2 billion per year as their clients become victims. Phishing is recognized as a fully organized part of the black market. Specializations emerged on a global scale that provided phishing software for payment (thereby outsourcing risk), which were assembled and implemented into phishing campaigns by organized gangs. 2005 In the United Kingdom losses from web banking fraud—mostly from phishing—almost doubled to £23.2m in 2005, from £12.2m in 2004, while 1 in 20 computer users claimed to have lost out to phishing in 2005. 2006 Almost half of phishing thefts in 2006 were committed by groups operating through the Russian Business Network based in St. Petersburg. Banks dispute with customers over phishing losses. The stance adopted by the UK banking body APACS is that "customers must also take sensible precautions ... so that they are not vulnerable to the criminal." Similarly, when the first spate of phishing attacks hit the Irish Republic's banking sector in September 2006, the Bank of Ireland initially refused to cover losses suffered by its customers, although losses to the tune of €113,000 were made good. Phishers are targeting the customers of banks and online payment services. Emails, supposedly from the Internal Revenue Service, have been used to glean sensitive data from U.S. taxpayers. While the first such examples were sent indiscriminately in the expectation that some would be received by customers of a given bank or service, recent research has shown that phishers may in principle be able to determine which banks potential victims use, and target bogus emails accordingly. Social networking sites are a prime target of phishing, since the personal details in such sites can be used in identity theft; in late 2006 a computer worm took over pages on MySpace and altered links to direct surfers to websites designed to steal login details. 2007 3.6 million adults lost US$3.2 billion in the 12 months ending in August 2007. Microsoft claims these estimates are grossly exaggerated and puts the annual phishing loss in the US at US$60 million. Attackers who broke into TD Ameritrade's database and took 6.3 million email addresses (though they were not able to obtain social security numbers, account numbers, names, addresses, dates of birth, phone numbers and trading activity) also wanted the account usernames and passwords, so they launched a follow-up spear phishing attack. 2008 The RapidShare file sharing site has been targeted by phishing to obtain a premium account, which removes speed caps on downloads, auto-removal of uploads, waits on downloads, and cool down times between uploads. Cryptocurrencies such as Bitcoin facilitate the sale of malicious software, making transactions secure and anonymous. 2009 In January 2009, a phishing attack resulted in unauthorized wire transfers of US$1.9 million through Experi-Metal's online banking accounts. In the third quarter of 2009, the Anti-Phishing Working Group reported receiving 115,370 phishing email reports from consumers with US and China hosting more than 25% of the phishing pages each.
2010s
… excerpt ends here. Continue reading the full article.
