Fraudsters Will Be Fraudsters, But How Does Provider Indifference Help?
I just got off the phone with the provider of some of my services, and it was a notable experience in exactly how indifference to fraud by a provider enables the fraudsters to continue in their dirty deeds.
Here's the particulars--I received an e-mail in my personal inbox that was clearly a phishing attempt. The sender e-mail domain was a pathetic attempt at spoofing the provider's, the sender identity was "resyq4ey", the body of the message contained multiple hypertext links whose text represented them as navigating to a web site to test my service, purportedly in concert with the FCC. Hovering over the text revealed an entirely different URL that was clearly going to take me to someplace bad.
I called the customer support representative to ask if there was an e-mail address for their security department (similar to what PayPal Resolution Center offers on their web site). Not only was he not aware of any such department, he further seemed totally disinterested in my problem or the possibility that he was just unaware of such a department that might exist in his enterprise. His entire response was "Just delete it."
I don't really hold the excessively-relaxed CSR in this case, but rather his management. Either there is, in fact, no arrangement for reporting fraudulent activity, or there is and the employee is unaware of it. In either case, management is holding the bag in this case.
This institutional blind spot to Enterprise Risk Management is not new nor confined to CSPs. I poignantly remember the situation from earlier in my career where a worldwide survey of Digital Equipment Company VAX minicomputers discovered 98% of the installed base to have the remote access superuser maintenance port still configured with the userid/password combination set to "test/test", much to the chagrin of the US Sandia National Laboratories when a cabal of Boy Scouts wiped their e-mail server clean.
I'd suggest that the industry should at least set a basic goal of making the fraudsters at least break a sweat as they perpetrate their nasty business.
Posted
02-08-2012 9:31 AM
by
Steven Cotton