PayPal CSO: Phishing Threat Overstated

SAN FRANCISCO -- RSA Conference -- Estimates of phishing’s impact on businesses may be exaggerated, according to the CISO at one of phishers’ most frequently-targeted companies.

Michael Barrett, chief information security officer at PayPal -- eBay's online payment service and popular target of phishers -- says that despite the storm of fake emails received by his company's 133 million customers, the company's actual losses from phishing are relatively low.

"Financially, phishing is not a terribly significant problem for us -- in fact, it's not even in the top five" threats that could cause losses at the financial services company, Barrett said in an interview here earlier today. "In fact, I suspect that many of the published figures on phishing's impact are significantly overestimated, probably by an order of magnitude."

PayPal is not taking the phishing threat lightly, however. Barrett estimates that as much as a third of his average day is spent focusing on phishing-related security issues, but it is important to keep the threat in context. "For us, the danger from ordinary credit card fraud is significantly greater," he says. "It's not as sexy as phishing, but that's the reality."

Many reports suggest that PayPal and its parent company, eBay, are among most frequently-spoofed sites on the Web, if not the most frequently spoofed sites. Those reports have led PayPal to roll out a new, optional VeriSign-based token that generates a random code to supplement the customer's username and password. The tokens, which cost $5 for individual users, will be activated later this month.

"We don't think this [token] is the be-all and end-all for us," says Barrett. "For one thing, it just isn't affordable for us to issue these tokens to all of our 133 million users." PayPal is considering other strategies for multi-factor authentication that may be offered in the future, he says.

The arrival of enhanced validation SSL (EV SSL), which is being demonstrated by CyberTrust and VeriSign here at the show, may also help users to recognize phishers, Barrett says. "We believe that users who use more modern browsers experience fewer problems," he says. "Anything that's added to the browser to help users recognize that they are being phished is a plus for us."

PayPal also is studying the correlation between a user's choice of ISPs and the incidence of phishing, Barrett says. "Clearly, one of the ways to reduce phishing is to reduce the number of phishing emails -- spam -- that the end user receives," he observes. "And the fact is that while some [ISPs] are doing very well with spam controls, others are hardly doing anything." In the future, PayPal may recommend some specific ISPs that are doing an especially good job stopping spam, he says.

Although PayPal and phishing have been closely linked in the media, Barrett says he spends most of his time doing humdrum tasks delegated to most other CSOs. "It's the usual stuff -- managing policy and enforcing it." PayPal is looking closely at the latest round of Trojan exploits, which could potentially be more deadly than any phishing attack, he says.

"Phishing is something we watch closely, but for most users, there's a simple solution: Don't click on URLs you find in email," Barrett says. "As a company, we're in the process of eliminating all embedded links in our emails, and there's no reason why a user should ever have to click on those links. It's a convenience, but it's not worth the risk."

— Tim Wilson, Site Editor, Dark Reading