Phishing: more clever, more evil, every day

This phishing scam, targeted at customers of Chase bank, is simple and direct. Fear it. Well, at least be aware of the general tendency of phishing scams to exploit basic human trust relationships with increasing sophistication. They get better and better every day, and they are building up quite a library of clever tricks.

• It looks like it came from your bank.
• The text is simple, direct, clear, and free from glaring grammatical errors.
• It appears to be a simple request. The apparent source of the email is obscured.
• It appears to be from: Chase Online Services Team
• It exploits the HTML processing ability of most modern email clients to obscure the actual target of the "click here" link (which I've removed, but which was obviously something other than chase.com.)

Here's the simplest, most direct, most likely to succeed phishing scam email I've seen to date:

Dear Chase Member: We have processed your request to change your e-mail address, based upon the information you supplied. Beginning immediately, we will send all future e-mail messages, excluding Alerts, to you at allenbauer@aol.com. Any e-mail addresses that receive Alerts about your accounts will need to be updated separately. If you did not request this e-mail address change or have any questions, please cancel this action and reactivate your account by clicking here. Please do not respond to this confirmation e-mail. Sincerely, Online Services Team

Phishing scammers don't use their own systems to harvest data for identy theft and credit card fraud. They use systems that belong to other people, which they have taken over without the knowledge of the owner. Often they take over large numbers of systems with worms or botnets. Intrinsic Security is working with Internet Service Providers to help stop botnets. Help us spread the word by linking to our site from your blog. Link to Intrinsic Security - join the antibotnet campaign.