Facebook IPO Unleashes a Phishing Frenzy

Just days after Facebook announced it was taking part in an effort to stop email phishing, the company is poised to announce its IPO and, ironically, give scammers a golden opportunity.

Economic desperation makes this the perfect moment for Facebook to file its initial public offering. Investors are hurting and want in on what will be the most hyped (and possibly lucrative) stock offering since Google went public. That economic desperation is also going to mean people are more willing to click on ads, download files and any other foolish online behavior if it promises them a chance to get in on the deal.

Regulators started reporting fraud related to this more than a year ago. Last March FINRA (Financial Industry Regulatory Authority) “issued a warning about scams that purport to offer investors’ access to pre-IPO shares of well-known social media companies, including Facebook. Seizing upon investor demand for shares of the private stock of high-profile companies, the con artists behind these scams are swindling the public by peddling non-existent shares of these companies.”

FINRA didn’t offer any details, but if that was going on a year ago we will see a feeding frenzy of scammers once the IPO actually hits (rumored for today).

Don’t hold this against Facebook, though. While it has been guilty of too many information breaches to count, it’s taking part in a major effort to rein in phishing attacks. The company has teamed up with Google, Yahoo, AOL (remember them?) and other major email services as well as financial firms including PayPal and Bank of America to develop a framework that hopes to thwart phishing attacks and other scams before they get to the intended victim.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a set of technical specifications that will provide message authentication without the sender or user needing to do anything . It will work in conjunction with existing mail authentication systems such as DKIM (DomainKeys Identified Mail) and SPF (Sender Policy Framework). More information on this can be found at DMARC.org.