Phishing - can software stop it?

A new programme to help companies combat the growing form of online fraud known as 'phishing' has been created by US internet security firm WholeSecurity.

Phishing starts with a forged email apparently from a legitimate company, such as eBay or Citibank, telling the recipient that his or her account information has expired - or something of the sort. The recipient is instructed to click on a link that leads to a fake website. The site asks for confidential data such as credit card numbers.

WholeSecurity is among a number of companies developing technology to alert consumers to phishing fraud. Its program, called Web Caller-ID, is already in use at eBay. The online auctioneer has incorporated the technology into its internet toolbar with a feature called Account Guard. It detects fraud sites purporting to be connected to eBay and its PayPal subsidiary with 98 per cent accuracy, according to WholeSecurity. The tool notifies users if they enter such a site.

Hundreds of thousands of eBay members have downloaded the free program since the company launched it in February, an eBay representative said.

Now WholeSecurity is trying to license the software to other companies doing business online, allowing them to incorporate it into their toolbars or distribute to their customers as a web browser plug-in. Scott Olson, WholeSecurity's senior vice president of marketing, said banks and other financial institutions are one of WholeSecurity's target markets for the product.

The program analyzes web addresses for clues that might lead to fraudulent sites. For instance, if the URL is long and convoluted, or if it consists of a long string of numbers separated by periods - an IP address - there's a good chance it's a false site, Olson said. The program also checks whether the domain name was registered recently or its operator is using a free web hosting service - all tell-tale signs of phishing activity, Olson said.

Other companies that offer antiphishing products include EarthLink, Webroot Software and PostX. Microsoft and Yahoo are also working on such programs.

Alorie Gilbert writes for CNET News.com