E-mail abuse is everywhere
Internet users don't know where to report scams
October is European Cybersecurity Month. So we asked the SIDN Panel about their experiences of malicious e-mail -- mail that's intended to cause direct or indirect harm to recipients. Our questionnaire was completed by 141 panel members. Almost all had come across mail-based cybercrime, but few thought that reporting malicious mail did any good, and most wanted better systems for reporting abuse.
October is European Cybersecurity Month. So we asked the SIDN Panel about their experiences of malicious e-mail -- mail that's intended to cause direct or indirect harm to recipients. Our questionnaire was completed by 141 panel members. Almost all had come across mail-based cybercrime, but few thought that reporting malicious mail did any good, and most wanted better systems for reporting abuse.
All panel members get malicious mail
Of our respondents, 70 per cent said they typically got 1 to 3 malicious e-mails a day delivered to their inboxes, not their spam folders. According to 55 per cent, the flow of malicious mail had increased over the last 12 months, but 9 per cent reported a drop. Malicious links and suspect attachments were the most common problems. In 30 per cent of cases, however, malicious mail came from scammers pretending to be one of the recipient's contacts and, for example, attaching a fake invoice.
Various types of scam familiar to panellists
Asked about the various types of malicious mail, panel members said they knew about almost all of them. Ransomware and identity fraud were seen as the biggest threats, with the latter highlighted as getting worse. It seems that cybercriminals are making increasing use of personalised mail, indicating some knowledge of the recipient.
"It's creepy when a scammer pretends to be someone you know, or claims to be you in mail to your contacts. That kind of thing can cause enormous damage."
SIDN Panel member
Few people report attempted scams
Only a small proportion of respondents who'd been targeted said that they reported the mail to their service provider or a report desk, and hardly anyone ever informed the police. The main factor influencing whether scams were reported was whether they came to anything. The vast majority of malicious mail doesn't result in any direct harm to the recipient, and very few people bother reporting that kind of mail. By contrast, two thirds of victims who actually lost out reported the matter to the police, their service provider or a report desk. Fraudehelpdesk.nl was the best-known report desk.
People unhappy with options for reporting malicious mail
Our survey also focused on what people can do about malicious mail. Most panel members said that they weren't happy with the options open to them, particularly for dealing with phishing scams. Respondents' answers often mentioned the lack of a recognised system for reporting such scams. Many people also saw reporting phishing scams as a waste of time:
"You can't get to the root of the problem, so you feel pretty powerless. I think that there should be a portal where internet users can report scams. Any domain that's the subject of more than a certain number of upheld complaints should be shut down."
SIDN Panel member
Some positive comments were made as well, however. The spam reporting button available with Google's Gmail service was highlighted by a number of respondents.
Victims mainly lose money and suffer identity abuse
When scams succeeded, victims usually lost money. Sometimes, though, victims discovered that the scammers had been impersonating them. That would typically involve hijacking the victim's Facebook page or sending pleas for money to the victim's e-mail contacts.
What can SIDN do?
Finally, we asked the panel what they thought SIDN should do about malicious mail. Two suggestions received consistent support: stricter authentication requirements for people registering domain names, and a ban on proxy registrations:
"Maybe tighten up the rules on .nl domains, and check that registrants are who they say they are. It's still relatively easy for a scammer to pose as legitimate by registering a .nl domain under a false name and setting up a website with a Let's Encrypt certificate. I realise that getting 6 million registrants to confirm their identity every 6 months would be a nightmare, but it would be good to reduce the scope for anonymity.
SIDN has recently banned proxy .nl registrations. However, our survey took place before the change, and panel members didn't have any advance knowledge of it."
SIDN Panel member
Interested in joining the SIDN Panel?
As the organisation behind the .nl domain, we like to hear what internet users, domain name registrants and entrepreneurs think about the internet and its use, and about topics such as security, privacy and domain names. Would you be interested in sharing your views with us, maybe anonymously? Then read what you can expect and register for the SIDN Panel.
