PhishCops® : What is Phishing?

Until recently, there have been few solutions to combat phishing. Internet Service Providers (ISPs) have experimented unsuccessfully with various forms of "filtering" or "blocking" software or hardware to try and shut down phishing webpages before their customers were affected. Unfortunately, most experts agree that such "filtering" approaches are fundamentally flawed for many reasons, including:

The number of phishing webpages is increasing faster than they can be identified and shut down by the ISPs. The Anti-Phishing Working Group (APWG) reported 2625 new phishing web-pages spawned in February 2005 alone. The majority go undetected and unreported.
Filtering or blocking a phishing webpage from reaching consumers can only occur after the phishing webpage has been detected by, or reported to, the ISP. By that time, however, the phishing attack has typically already been launched. Such “post-attack” remedies are akin to “closing the barn door after the cow has already escaped”.
Many Internet Service Providers resist imposing filtering software on their systems.
Many Internet Service Providers are located in foreign countries where it is difficult to coordinate or enforce filtering efforts.
Some Internet Service Providers actually encourage the propagation of phishing webpages since it results in increased local hosting revenues.

Companies such as Microsoft and Symantec have spent enormous sums of money attempting to develop software-based solutions such as "Sender ID", browser "toolbar" controls, and other forms of digital signature recognition software. These software-based approaches are flawed for many reasons, including:

They depend on consumers being willing and able to install software, proprietary browsers, or other controls onto their local computer systems. Consumers have been resistant to such efforts.
The various software tools are incompatible with each other, with one tool blocking websites that have registered with a competitor. This results in erroneous and selective blocking by the different software solutions because of a website being perceived as being “unsigned” when it has, in fact, simply registered with a competitor or chosen not to participate at all.
Given the diversity of operating systems, browsers, and software drivers around the world, no single software system will be installable and useable by 100% of the internet audience.
For each new phishing webpage that is identified, the database of known phishing websites must also be updated. Experts agree this is a hopeless task since the number of phishing webpages is growing faster than they can be shutdown. Also, by the time a phishing website is identified and reported, it is too late since the attack has already been launched.
The vast majority of websites are maintained by small businesses or individuals, many of whom elect not to register their website with the ID Authority for personal or financial reasons. As a result, consumers who subscribe to such software systems are unable to reach a large number of, otherwise valid, websites.
Such solutions are not voluntary. Requiring a business owner to register their website with the ID Authority in order to reach their intended consumers, while simultaneously preventing consumers from accessing websites who do not subscribe with the ID Authority, flies in the face of growing demands for GREATER access to the internet by businesses and consumers, not less.

Virtually all anti-phishing efforts to date have focused on one of the above failed approaches. There has been little effort made towards developing an anti-phishing solution that individual business owners can implement themselves, without the assistance of an ISP or software company, and without requiring customers and business owners to give up yet more privacy. As a result, phishing has continued to grow.

In desperation, and without any workable solution, business owners have resorted to simply placing printed warnings on their webpages, urging their customers to check the URL address of any company webpage. These printed warnings represent the most common approach business owners have taken to try and protect their customers from phishing.