Phishers spoof campaign site

Phishing fraudsters have found another group of victims to target — people who want to donate to political campaigns.

Late Sunday, SurfControl, a web and email filtering software vendor based in Congleton, UK, noticed two apparent scams targeting people wishing to donate money to John Kerry's US presidential campaign. Email with the subject line "President John Kerry, please vote and contribute" directed recipients to two websites, one registered in India and the other in Texas.

The so-called phishing scam — stealing credit card numbers and other personal information by using spam email to direct people to spoofed websites — has been around for years, but this is the first political phishing scam SurfControl has observed, says Susan Larson, vice president of global content at SurfControl.

This latest scam doesn't appear to have a political motivation, just an economic one, Larson says. The scam email appeared within days of the end of the Democratic National Convention in Boston, she notes.

Phishing scammers can use current events to support their claims, Larson says. "They want people to think they have to do this now," she adds. "That's typical of the way they get the best hit."

Both sites were designed to look like Kerry's official campaign site, www.johnkerry.com, Larson says. Neither of the apparently spoofed sites was still operating as of late Tuesday, which along with the odd registration locations, led SurfControl to conclude the sites were not legitimate, she says.

The bogus email directed recipients to testhost.yahoogoogle.biz/JohnKerry/contribute.html, registered in India, and www.johnkerry_edwards.org, registered to an individual in New Braunfels, Texas, according to SurfControl.

"It was a very legitimate looking email," Larson notes.

People with concerns about email asking for political donations should contact the campaign directly — in this case, at johnkerry.com, Larson advises.

Scammers using phishing tactics typically send out email targeting users of financial institutions or other e-commerce sites. The bogus email message often tells recipients there's a problem with their accounts, and that they need to re-enter their bank account number or credit card number at a website designed to look like the legitimate e-commerce site.

An estimated 57 million US adults had received phishing scam email as of May, according to Gartner. Phishing attacks increased 500% between January and May 2004, and an estimated 3% of phishing email recipients fill out the forms on spoofed Web sites, Larson says.