Suggestion: Reporting Phishing

[absoluteevel]

I feel there should be a checkbox on the spamcop site that will allow you to indicate a spam you are reporting is a phishing attempt. This would then add 'spam[at]uce.gov" to the list of people the spam is reported to. This email address is the "Phishing Department" at the Federal Trade Commission.

Another thing that might be useful would be a pulldown that would appear if you indicate the email is a phishing attempt. This box would have banks and places like PayPal listed, and you would select which bank was being spoofed, and that bank's fraud department would be added to the list of people the spam is reported to. From the few I've received and reported in the past few days, it looks like the email address is normally spoof[at]bankdomain.

These suggestions, if implemented, could save a lot of time, trouble and money for a lot of people, since all of the right people would be notified right away to get the bad sites offline before people are taken advantage of.

Oh... And add 'reportphishing[at]antiphishing.org' to the list of people who would be notified.

Chris

Chandler, AZ

[Wazoo]

This would then add 'spam[at]uce.gov" to the list of people the spam is reported to. This email address is the "Phishing Department" at the Federal Trade Commission.

Not really (check the link in the FAQ 'here') This address is used for the collection of any and all spam, which then gets put into storage. These stored spams are then made available to other agencies, such as other Government offices, law enforcement, certain legal activities, etc.

Another thing that might be useful would be a pulldown that would appear if you indicate the email is a phishing attempt. This box would have banks and places like PayPal listed, and you would select which bank was being spoofed, and that bank's fraud department would be added to the list of people the spam is reported to. From the few I've received and reported in the past few days, it looks like the email address is normally spoof[at]bankdomain.

These suggestions, if implemented, could save a lot of time, trouble and money for a lot of people, since all of the right people would be notified right away to get the bad sites offline before people are taken advantage of.

And the flip side to that is the historical problem of users that click on anything and everything in sight. I know, everyone says that they are careful, yet .. folks report themselves, their ISP, legitimate e-mail from their friends, even comfirmation e-mails from SpamCop advising that their spam submittal was accepted for reporting action ....

Trying to figure out reporting addresses that may or may not exist, which institutions actually do want to hear about any of this (much less do anything about it), plus adding in more code to manufacture this additional notify to clearly indicate its purpose .... think you might be better off continuing the research you've been doing and feed the other organizations involved (Marjolein's Ban-spam site for instance ... also found in the FAQ 'here')

Note: edited your first post to include the single-line entry in your second post .. then deleted the second post ....

[StevenUnderwood]

Any address you would like to include (up to the character limit) can be added to your own account without any changes being made for everyone else.

[Jeff G.]

Any address you would like to include (up to the character limit) can be added to your own account without any changes being made for everyone else.

21861[/snapback]

That option is only for paying customers. The free users have to send Manual Reports.

[StevenUnderwood]

Since the recent change to the reporting site where the free accounts are simply paid accounts with no fuel, even free accounts have the capability to add public report recipients under Preferences, Report Handling Options

Public standard report recipients

If you wish others to receive a copy of every spam you submit, enter the email address here. Please do not send to any address which is not receptive to receiving untargetted spam reports. Note this will create only one copy for each spam, even if there are multiple reports per spam.

[jongrose]

If someone would create a database of all the addresses of banks and online fraud departments that respond to phish emails and work with the ISP to take down the sites, sort of like abuse.net has done for abuse addresses, then that might be easier to implement. (ie spoof[at]paypal.com, etc)

That way, once the system recognizes a phish attempt, it could query a database and just fwd it to the proper place.

[silentlarry]

If someone would create a database of all the addresses of banks and online fraud departments that respond to phish emails and work with the ISP to take down the sites...

21890[/snapback]

See

http://banspam.javawoman.com/report3/index.html

[Jeff G.]

That's what I get for not reporting spam as a free user on occasion - sorry for the misinformation.

[jongrose]

See

http://banspam.javawoman.com/report3/index.html

21912[/snapback]

Cool, so why not add those addresses to optional parties to email in Spamcop reports? I guess the real question is, is if those addresses ever get checked or answered, and if that option were added, would they be flooded with requests and it bogs them down even more.

[StevenUnderwood]

Many of those addresses were in the spamcop system at one time and spamcop was asked to remove them, probably due to the volume being received.

Many other useful features have had to be whittled down because of overactive reporting and abuse of the system (the manual list of addresses to be added used to be much more than 200 characters).