'Verified by Visa' phishing scam detected

A phishing scam has been detected that uses the ‘Verified by Visa' authentication program.

Webroot's Andrew Brandt claimed that the scam begins with an email that appears to be targeted at shoppers who buy gifts online. Brandt said: “Once you register with the (real) Verified by Visa service, participating merchants permit you to enter a password in addition to your card information.

“In addition to providing the purchaser with an additional layer of safety, the password also gives the merchant some assurance that larger-than-normal transactions (like the ones you make during holiday shopping season) will be approved quickly, without triggering fraud alerts.”

However, Brandt pointed out that in the email, the user is sent to a web page that asks you for the information you gave the card-issuing bank at the time you first signed up for the credit card. He also commented that the page is clearly more professional, slick and clean than most phishing pages as the form's businesslike appearance serves to reassure the victim that the page really belongs to Visa.

“The form data is supposed to be sent over a secure HTTP connection (with an HTTPS prefix before the website's URL in the browser's address bar), but this one clearly is using a standard HTTP connection,” said Brandt.

“Verified by Visa is, potentially, capable of helping reduce fraud and may also prevent criminals from using stolen credit card numbers. Just make sure you're signing up for the right program, not handing your wallet over to crooks.”

See original article on scmagazineuk.com