Bob Cringely suggests
that when you receive those e-mails posing as eBay or your local bank,
go to the scammer’s site and enter false information. His theory
revolves around the numbers:
If the bad guys out-number the cops by 1,000-to-1, Internet users must outnumber the bad guys by 100,000-to-1 or more.
Fear of punishment won’t deter phishing, yet that’s all traditional law
enforcement has to offer. It’s fear of UNPROFITABILITY that will
finally work.
The simple way to kill phishing is by making it harder for the
phisher to make money from it. Right now, a phisher sends out a million
e-mails and gets back 100 replies that yield positive data. There is
almost no effort involved in sending out the e-mails after the first
one, and the quality of the return data is very high. No wonder this is
such a popular business!
Let’s change that. If you get phishing e-mail, go the web sites and
enter false data. Make up everything — name, sign-on name, password,
credit card numbers, everything. Instead of one million messages
yielding 100 good replies, now the phisher will have one million
messages yielding 100,000 replies of which 100 are good, but WHICH 100?
This is an interesting point. While I was reading the article, I
thought that he would suggest yet another “Internet postage stamp”
solution where we would pay for e-mails then refund our friends or yet
another authentication scheme. (Both are difficult to implement as they
break what we currently have.)
So… can we stop phishing together by flooding the phishers?