In addition to the typical phishing targets, such as Citibank, eBay, Paypal and US Bank, we've been seeing a move towards smaller markets. This is probably happening as most customers of a bank like Citibank have already received a hundred different phishing messages and will not be fooled by another one.

So phishers are doing more targeted attacks against smaller targets in order to find users who still could be fooled to respond to a phishing email.

This has resulted, for example, in a series of attacks against the German banks, with increased activity against organizations like Deutsche Bank and Postbank.

Here's an example of a phishing message against Postbank from last weekend:



As a result, both Deutsche Bank and Postbank will be introducing one-time passwords which are needed to authorize online transactions. This is something the more advanced banks have been doing since 1991 or so, and which many of the large american banks are still not implementing.

Financial Times Deutschland is reporting that German banks lost 70 million Euros due to phishing attacks over the last year and this figure is growing fast.