Phishing: Crime that pays

Email phishing requires functional countermeasures, as does any crime that results in millions of dollars in yearly losses. Many financial institutions currently combat phishing by contracting takedown companies that remove relevant phishing websites as soon as possible after they are detected. By comparing the median time necessary for professionals to take a phishing website down to the average time it takes for a phishing website to turn a profit for its creator, I have demonstrated the overall ineffectiveness of the takedown process. On average, takedown companies fail to eradicate phishing websites before their creators garner valuable information from multiple victims. Furthermore, forensic evidence that could lead to the arrest of the cybercriminals responsible for the phishing websites is often ignored because these takedown companies do not profit from cooperating with criminal investigations. Hence, there is no deterrence against phishing. An anti-phishing protocol that involves website takedown, but also includes investigation and eventual prosecution would likely be more effective than a self-perpetuating system that concludes after a malicious website is terminated.