Anti-Phishing, DMARC , Email Threat Protection

Phishers Impersonate NACHA

Payments Association, IRS Among Latest Targets
Phishers Impersonate NACHA
NACHA, the Electronic Payments Association, has posted an alert about a targeted phishing scam that appears to be hitting up recipients for ACH transaction details.

NACHA declined to elaborate on the scheme, but according to the organization's website posting, the fraudulent e-mails often vary in content and appear to be transmitted from e-mail addresses associated with the NACHA domain, @nacha.org. Some of the e-mails have also contained the names of fictitious NACHA employees and/or departments.

"NACHA itself does not process nor touch the ACH transactions that flow to and from organizations and financial institutions," the posting reads. "NACHA does not send communications to persons or organizations about individual ACH transactions that they originate or receive."

NACHA's post goes on to note that phishing attacks are often launched as a way to hijack personal information or route users to pages that host malicious code or software. NACHA recommends users view the Federal Deposit Insurance Corp.'s guidelines about phishing scams for more information.

Phishing Season

NACHA is just one of several agencies being used as a veil for fraudulent requests of information launched by vishy or phishy pilferers. Recent reports of phishing e-mails appearing to be from the Internal Revenue Service have cropped up this week, just in time for tax-filing season. And in September, phone-based phishers, more often called vishers, posing as the FDIC, hit unsuspecting consumers for personal information used when applying for loans.

George Tubin, a fraud analyst at TowerGroup, says he's surprised that any fraudster would use NACHA as a guise for a socially engineered attack, since most consumers don't know the organization. "But this has been going on for a while," he adds. NACHA first reported suspicious e-mail activity connected with its name in July.

According to the Anti-Phishing Working Group, 54 percent of home-based PCs are infected with some kind of malware, and phishing e-mails are often to blame. ID theft expert Robert Siciliano says phishing attacks are easy to launch and hard to stop. "It's very easy to purchase a phishing kit online; anyone can do it," he says. "It's just becoming so easy, and it's just going to keep getting worse before it gets better."

Outdated Windows operating systems and browsers also increase vulnerability, Siciliano says. "It amazes me that phishing is still even possible, and, beyond that, that phishing e-mails can even still come through," he says. "But so many people are using outdated systems or outdated browsers, these attacks are able to get in where newer technology would have them blocked."


About the Author

Tracy Kitten

Tracy Kitten

Former Director of Global Events Content and Executive Editor, BankInfoSecurity & CUInfoSecurity

Kitten was director of global events content and an executive editor at ISMG. A veteran journalist with more than 20 years of experience, she covered the financial sector for over 10 years. Before joining Information Security Media Group in 2010, she covered the financial self-service industry as the senior editor of ATMmarketplace, part of Networld Media. Kitten has been a regular speaker at domestic and international conferences, and was the keynote at ATMIA's U.S. and Canadian conferences in 2009. She has been quoted by CNN.com, ABC News, Bankrate.com and MSN Money.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing govinfosecurity.com, you agree to our use of cookies.