National Threat Assessment 2008. Organised Crime - Politie

equired to defraud Internet users can currently be found or bought online.
Ready-made email messages and web pages pretending to be the web pages
of popular banks and webshops are available, as well as email lists and servers.
Botnets are available at reasonable prices. Spyware is also available via special
Internet sites.
5.5.3 Scale
The NTA follow-up study in 2006 reported a massive global development
and this development has continued since then. According to the Anti-Phishing
Working Group (APWG) 69 , the number of phishing websites has increased
dramatically in recent years. In July 2004 a total of 584 unique sites were
identified, after which a gradual increase was observed until mid-2006.
Afterwards the pattern started fluctuating: in April 2007 the number of reports
peaked at 55,643, whilst the number dropped again in the final months of
2007. The most recent data relate to January 2008, when 20,305 unique
phishing sites were reported. Two percent of the phishing websites are located
in the Netherlands, but this does not automatically mean that the owners are
also in the Netherlands.
The number of reports to the police and notifications in the Netherlands is
increasing slightly: 15 in 2005, 25 in 2006 and 27 in the first 10 months of
2007. However, this is no indication for the actual number of phishing victims.
After becoming a victim of phishing, people first of all contact their bank or
credit card company, which reimburses them for any losses incurred. There is
then no real (personal) need to report the incident to the police. If the victim
does file a report with the police, this report will often not be recognisable as
a case of phishing in the registration system. According to banks and credit
card companies in the Netherlands, they had to deal with about 100 phishing
campaigns in 2006. Minor incidents are often resolved by their own security
departments. For more serious incidents they call in Govcert.nl (the Dutch
government’s Computer Emergency Response Team). The Computer Emergency
Response Team was called in on approximately 70 incidents between February
2006 and March 2007. The National Crime Squad’s High Tech Crime Team
also conducted two investigations in 2007 that were related to phishing.
69
An organisation set up on the initiative of companies and sponsored by companies,
with the aim of preventing identity theft and fraud by means of phishing worldwide.
198 National Threat Assessment 2008 – Organised crime