Last week, the Anti-Phishing Working Group, an online fraud watchdog, reported that the number of it tracked between January and February grew by only 2 percent.
That figure seems to mark a significant lessening of the threat, given that the average growth rate has been 26 percent per month since July 2004. But during the January-February period, phishing attacks also became dramatically more complex, experts said.
Whatever form they take, phishing fraud schemes--including offshoots such as pharming,and --are getting smarter.
"Phishers are thieves, and thieves in the online world, as in the real world, are working very hard to separate personal financial information and other data from their victims," Microsoft attorney Aaron Kornblum said.
The software maker recentlyagainst alleged operators of phishing Web sites--a major step forward in thwarting online criminals, according to Kornblum.
However, he acknowledged that there may be as much to fear in the future of phishing as there is to learn from its past.
"People will continue to think up news ways to apply phishing techniques and deceive consumers," he said. "The sophistication is growing, and it's not that surprising at all."
New crooks, more-effective tricks
The first wave of phishing attacks played on the ignorance of unsuspecting consumers, spamming their in-boxes with e-mails that looked like they linked to , investment companies and e-commerce businesses such as eBay. In reality, they were fake pages designed to lure people into divulging account login data, or other sensitive personal information that could enable the crooks to commit .
Recent attacks have gotten more sophisticated, with advances in phishing schemes that use e-mail and the creation of fraudulent Web pages that appear almost identical to their legitimate counterparts.
One of the most telling examples of improved social-engineering techniques is a recent attack that didn't seek to nab victims' names, addresses or Social Security numbers.
Instead, the scheme targeted customers of, with the aim of stealing information stored on the company's databases.
The campaign began with an e-mail sent to Salesforce customers that promised new application features under a free trial if the