A phishy mess

Robert X. Cringely examines just why phishing scams are so hard to shut down. One of the more attention-getting reasons that he cites:

... a large group of phishing victims -- banks and credit card companies -- don't want to publicize their losses, which might lead to a loss of business as customers start to worry about being victimized. But it goes even further, because the financial institutions are only on the hook for reported thefts. So by not making a big deal of it, maybe you won't notice that extra $30 charge and won't demand that your credit card company cover the loss. Being upfront about phishing could easily double corporate losses because of it by forcing these outfits to actually assume the risk that they say they'll assume.

So nobody talks about it, and the costs of phishing are generally hidden in the average eight percent that credit card companies figure they'll lose through theft, bankruptcies, etc. In a business with interest charges often going above 20 percent, phishing is tolerable.

He also looks at some possible solutions, including PayPal co-founder Max Levchin's idea of offering bounties to people who help spot new scams and track down the culprits.