IEEE Spectrum May, 2016 - 54

could you fall for a scam?

we alSo aPPly a barrage of statistics to messages. To formulate this technique, we began by taking a representative
sample of everyday language and counting the frequencies
and stranded-traveler scams ("Mom, I'm penniless in Paris. with which important words appear.
After that, we compiled a training set of confirmed scam mesPlease send money"). We have developed other filters to identify many categories of scams. For example, there is classi- sages-more than 200,000 of them are now in our database. Then
fication by style. Much as you can guess the age of a movie we listed the most common phrases having two, three, four, or
from the slang in the dialogue, so can an algorithm catch for- five consecutive words, and their frequencies. Some of the differmulations that are commonly used by scammers. Such for- ences between normal language and scam language were subtle,
mulations change slowly because scammers, like just about but others jump out at you. For example, consider the phrase
"reply urgently." In a large sample of reported scams from 2005,
everybody, prefer to reuse successful gimmicks.
about one out of every 200 messages contained that phrase, whereas an astounding one in 18 contained the phrase "plane
crash." Both of these phrases are much less
NEW VERSION!
common in legitimate messages.
But wouldn't such a filter have a high
error rate? After all, people send perfectly
legitimate messages containing the words
"plane crash" all the time. Indeed, the
error rate would be high if our algorithm
looked at only that one phrase. Finding
a single phrase that's much more common in scam messages than in regular
language is only indicative of a scam. But
when an email contains a set of phrases
that often occur together in fraudulent
emails but very rarely in normal language-
such as "introduce myself," "airplane
crash" and "large sum"-then you can
be confident that the message is bogus.
Let's now consider who the sender is-or
appears to be. One way scammers try to
win the trust of the victim is by pretending to be a trusted source-one method of
which is email spoofing. This trick was supposed to have been ended by an Internetlevel convention known as Domain-based
Message Authentication, Reporting and
Conformance (DMARC). But DMARC
hasn't been fully implemented. Some
organizations haven't supported it yet,
whether for cost reasons or because of the
training required to deploy it. Some counOver 100 new features &
Over 500,000 registered users
tries, such as France, Germany, Italy, and
improvements in Origin 2016!
worldwide in:
Japan show only 35 percent to 40 percent
◾ 6,000+ Companies including
FOR A FREE 60-DAY EVALUATION,
DMARC coverage. And scammers con120+ Fortune Global 500
GO TO ORIGINLAB.COM/DEMO
tinue to set up mail servers that insert fake
◾ 6,500+ Colleges & Universities
AND ENTER CODE: 8547
sender information into emails.
◾ 3,000+ Government Agencies
& Research Labs
To catch them, we home in on the
weak spot of such spoofing: the replyto address. Scammers need it to ensure
that the victim's response goes to them
20+ years serving the scientific
rather than the apparent sender. Our
& engineering community
algorithm looks for such addresses, particularly those that the sender hasn't

co nti n u e d f ro m pag e 4 3

may 2016

North americaN

SPectrUm.ieee.orG

http://www.ORIGINLAB.COM/DEMO http://SPectrUm.ieee.orG

Table of Contents for the Digital Edition of IEEE Spectrum May, 2016