Security solutions to the phishing: Transactions based on security questions and image

Abstract

One of the latest computer-related problems to arise is phishing, which is the criminally fraudulent process in which e-mails lure unsuspecting victims into giving up user names, passwords, Social Security numbers, and account information after linking to counterfeit bank, credit card, and e-commerce Web sites. Phishers are mainly targeting the customers of banks and online payment services. It is so pervasive that even corporate and government sites are actively informing the users on this issue. This paper presents a solution, which aims to protect users against email phishing attacks. Main key words which are used are a user ID and password, and the other is an authenticating question. An e-mail that a bank sends to user contains some image and preselected question which the phisher couldn't have, that the user chose when setting up the account. This proves to the user that the e-mail came from the bank or business, not a phisher, and that it is safe to use the provided link. The user is asked to provide his ID and the bank checks if the ID is valid or not. If the ID is valid, the user is asked to load the image which has been mailed and answer his preselected question along with a request for their logon password. After receiving the correct password, user is allowed to access the Web site. © 2010 Springer-Verlag Berlin Heidelberg.