The best phishing e-mail I've seen recently purported to come from none other than the head of the FBI. "Robert Mueller" was offering to ensure the safety of a money transfer from a confidential third party, if only the recipient would provide her or his bank information in an official-looking form.

Being the inquisitive sort, I was fascinated that the director of the FBI would use a foreign e-mail address, that the form didn't appear to have been prepared by a native speaker, and that the FBI would provide "advance fee" funds transfer services. Nonetheless, some recipients of the e-mail have likely taken the bait, and find their self-assurance and bank balances thus reduced.

Well-executed confidence jobs are ones where the victim not only becomes convinced of the trustworthiness of the perpetrator, but acts as an advocate and defender of the process by which he or she is relieved of assets. In most cases, somewhat skeptical people can spot a phishing attempt because the request comes from an unprompted and dubious source. But what happens when the request appears to come from an authoritative, familiar source, and double-checking the address shows it originated from within one's own organization?

Con jobs on the job

This is not a hypothetical problem. Recent incidents, some made public and others discussed only in professional circles, indicate that an increasing number of successful intrusions into large organizations haven't aimed to steal the organization's data or resources, but to victimize the employees as individuals.

Instead of an outlandish request to send personal information and a few thousand dollars to facilitate the payout of umpteen millions from a long-lost royal relative in a defunct African republic, or a plea from the President to help funnel money from Iraq, the new phishing e-mails are frighteningly plausible.

For example, an employee might receive an e-mail claiming their direct deposit information had been lost in a system upgrade, and to please e-mail their account numbers and a scanned bank deposit slip to an address in the human resources department. There's little in a message like that to tip off potential victims, even if the phishing attempt is more aggressive -- say, a request to donate to a corporate-sponsored charity by providing credit card data, including a CVV2 number.

Even technically and financially astute people might send sensitive information via e-mail within an organization, assuming the data would never touch public networks such as the Internet. This assumption is even built into the Payment Card Industry Data Security Standard ( PCI-DSS version 1.1), which only requires "encrypt[ed] transmission of cardholder data across open, public networks."