FORT WORTH, Texas — In a few years, phishing has gone from a largely unknown Internet crime to one of the most prevalent, with increasingly sophisticated and creative attacks targeting even the smallest of credit unions. In fact, the Anti-Phishing Working Group, a global pan-industrial and law enforcement association focused on eliminating fraud and identity theft that result from phishing, reports that unique phishing site URLs went up 757% between Oct. 2005 and Oct. 2006. The burden of dealing with these attacks has grown from a simple nuisance to an overwhelming maintenance issue.

John Brozycki, information security officer at Hudson Valley Federal Credit Union, Poughkeepsie, N.Y., detailed attackers' latest tricks, best practices for minimizing the risk, and what incident response procedures are most effective at the recent CUISPA IT Risk Management Summit.

A year ago, phishing–a scam that attempts to impersonate a legitimate, trusted institution to get people to expose information or take a desired action–largely focused on collecting credit card numbers, account numbers and passwords. Computer graphics were primitive, but still convincing to many users. Each phish was a means to an end.