Sample Electronic Fraud Prevention Guidelines:

Document History

Version	Date	Revised By	Description
1.0	1 August 2009 <Current date>	Michael D. Peters <Owner's name>	This version replaces any prior version.

Document Certification

Description	Date Parameters
Designated document re-certification cycle in days:	30 - 90 - 180 - 365 <Select cycle>
Next document re-certification date:	1 August 2010 <Date>

Sample Electronic Fraud Prevention Guidelines

The <Your Company Name> (the "Company”) Electronic Fraud Prevention Guidelines defines objectives for establishing specific standards on the assessment and ongoing management of vulnerabilities.

The Electronic Fraud Prevention Guidelines builds on the objectives established in the Vulnerability Management Standard, and provides specific instructions and requirements for assessing and prioritizing vulnerabilities.

I. Scope

All employees, contractors, part-time and temporary workers, and those employed by others to perform work on Company premises or who have been granted access to Company information or systems, are covered by this policy and must comply with associated standards and guidelines.

Information Assets are defined in the Asset Identification and Classification Standard.

Phishing is the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication.

Risk refers to the likelihood of loss, damage, or injury to information assets. Risk is present if a threat can exploit an actual vulnerability to adversely impact a sensitive information asset.

Sensitive Information refers to information that is classified as Restricted or Confidential. Refer to the Information Classification Standard for confidentiality classification categories.

Threats are the intentional or accidental actions, activities or events that can adversely impact Company information assets, as well as the sources, such as the individuals, groups, or organizations, of these events and activities.

Vishing is the criminal practice of using social engineering over the telephone system to gain access to private personal and financial information from the public for the purpose of financial reward.

Vulnerabilities refer the weaknesses in information system and procedures including technical, organizational, procedural, administrative, or physical weaknesses.

II. Objectives

The below guidelines are to be followed when mitigating the risk brought about by the threat of Phishing and Vishing attacks against the Company:

Phishing and Vishing Detection Procedures

Phishing and Vishing take-down initiation can come from several sources. Customers as well as non-customers are encouraged to forward phishing emails or phone based Vishing attacks to the Company email address that is monitored by Information Security Incident Response team members. This email address is: abuse@yourcompany.com.

Customer Support

• Phishing stuffers or other forms of written publications should encourage customers to be on the lookout for and report suspicious communications and obvious Phishing or Vishing activity to any Company representative who should in turn report this information to Information Security.
  

Third Party Support

• Phishtank.com

• Phonephishing.info

• GonePhishing.org

• Millersmiles.co.uk

• Garwarner.blogspot.com: Gary Warner who performs malware and phishing research also sends notification to phished entities when he finds them on the web.

Vishing Site Takedown Procedures

Phishing phone calls usually appear to come from a well-known organization and ask for your personal information, such as credit card number, social security number, account number or password, and so forth. Usually, phone phishing attempts pretend to come from services or companies with which you do not even have anything to do.

While phishing e-mails usually tell you to click a link to a website and submit your personal information, phone-based phishing directly ask you for such information. Legitimate organizations would never request this information of you via email or phone.

• Identification

1. Using the caller’s phone number, perform a White Pages reverse lookup of the number:
   • Phonenumber.com/reversephone
   • Enter the phone number in the “Reverse Phone” lookup.
   • The name and service provider will be returned:

   • Make note of the name and phone number. Navigate to the service provider’s website (Google it if necessary). Search the service provider’s contact us information for their abuse contact email address. Since AT&T bought South Central Bell or Bell South, go to the AT&T website:

   • att.com
   • Email address: abuse@att.net

2. Next, compose an email like the one below being sure to BCC the FBI:

   • This process is normally sufficient. If, for some reason, the Vishing attack persists, call the legal, abuse, or support line of the service provider. Explain the attack and that the authorities have been notified. Usually, the FBI will contact the service provider directly for the information on the subscriber for their case file and direct the subscriber to take down the line, which never fails.
     

Phishing Site Takedown Procedures

Phishing is a fraudulent attempt, usually made through email, to steal your personal information. The best way to be protected from phishing is to learn how to recognize a phish.

Phishing emails usually appear to come from a well-known organization and ask for your personal information — such as credit card number, social security number, account number or password. Often times phishing attempts appear to come from sites, services and companies with which you do not even have an account.

In order for Internet criminals to successfully "phish" your personal information, they must get you to go from an email to a website. Phishing emails will almost always tell you to click a link that takes you to a site where your personal information is requested. Legitimate organizations would never request this information of you via email.

• Rock Phish

• Once the URL of the phishing website has been determined, ping the domain name to obtain the IP address. You can also do an nslookup to see the other IP addresses related to the phish. With Rock Phish there will be several IPs.

• Go to http://internic.net/whois.html to determine the Registrar and NS entities. For domains ending in anything other than .aero, .arpa, .biz, .cat, .com, .coop, .edu, .info, .int, .jobs, .mobi, .museum, .name, .net, .org, .pro, and .travel, you’ll need to use the universal whois server of your choice for that domain. Try http://www.uwhois.com/.

• Domain Name Takedown

• Certain domain names infringe on <Company Name>’s name and/or trademarks. This is illegal and grounds for revocation of the domain name by the registrar, Rock Phish or otherwise. If there is no other legitimate content being hosted by the domain besides the phish, this is also grounds for domain revocation.

• Once you have the Registrar information, go to their website and look up their contact information for support and/or abuse.

• Name Server Takedown

• The Whois lookup will usually include Name Server information. Find the NS owner and go to their website to find their contact information. Prepare a takedown email to the NS owner making sure to include the CERT / CSIRT authority in the TO: field.