The UK today is one of the main attack targets by phishing organized crime groups, globally.

Globally, phishing damages will amount to about two billions USD in 2006. Not counting risk management measures such as preventative measures, counter-measures, incident response and PR damages.

In most cases, phishing is caused by the fault of the users, either by entering the wrong web page, not keeping their computers secure or falling for cheap scams. Often this is due to lack of awareness or ability in the realm of Internet use rather than incompetence by the users.

Still, these attacks are aimed at the banks and the financial institutions themselves, just because they are done in a distributed fashion on the micro level, attacking multiple users rather than on one centralized point (the web page) does not change that.

In Britain, by law, the risk of phishing is on the banks alone. Any damages caused by phishing attacks are to be reimbursed completely. In other countries the risk is on the clients alone, a combination of both bank and client, or no legislation exists yet.

In all these countries the banks mostly offer complete assurance and/or completely reimburse clients regardless, as protecting the web channel for banking (being the cheapest one) is very important to them. This is about maintaining the effectiveness and trust of the populace in eCommerce.

In very rare cases, banks choose to manage their risk differently and they abandon the web channel, likely due to very low usage. Banks are often short-term sighted with their risk management compared to the current revenue loss vs. gain when it comes to technological risks. The acceptable risk in the banking world changes constantly and what could have been prevented years ago was very smartly managed, but not fine-tuned for the technology risks involved.

Still, in realms other than technology, such as economics, their way of risk assessment seems to work to a great extent.

In today’s world, phishing has become a risk to be reckoned with under any risk management methodology, with some banks losing as much as several million USD a day during massive attacks.

What this caused is for banks to have to find ways to maintain the cheap and efficient web channel, while maintaining their PR toward their clients (the clients confidence in the bank), yet still finding a way to cut their losses.

This is not what we are discussing here, though.

The more a bank losses and tries to add security measures, the more its competition is going to reduce security measures and allow clients a more easy and functional web channel.

The problem with that strategy though, is that two weeks to a year later, the direct competition is going to be under attack. The competition made the wrong risk assessment decision as its revenue was not hurt the year before. The original bank’s attack has reached saturation that will last for a few months to a year, staying in lower yet maintained levels of damage. This will turn and change constantly from that point on.

This wheel keeps turning.

Banks need to realize they need to work together on matters of security, compare notes and share intelligence. The risk exists, and because you have it easy now—know that you are about to be targeted. This is a fact. Take it into consideration.

Competing on security is the worst thing banks can do. Illegal activity today is no longer a shame when it hurts you, it is a test that shows how well you deal with it in comparison to others. You can’t deal with it alone.

With phishing the banks have the potential benefit of learning from the lessons of countries that suffered from these attacks before, such as the UK.

Considering that the technology used for phishing and the ways to mitigate the risk keep changing, there is no better way to manage this risk.

I am very doubtful many of them will until they are already targeted. Once targeted, they will waste 2-4 years learning this simple truth. They have so far, wherever phishing went.

Sharing information is to your benefit. Withholding it will cost you.

The question remains, how does the sharing happen, and how is it done safely? That is a discussion for another time.