Phishing doesn't pay, claims Microsoft

Phishing is a low-skill and low-reward business, with few phishers earning much money, according to a study by Microsoft Research.

Researchers Cormac Herley and Dinei Florencio said that the average phisher would make as much money as if he did something legal with his time. They said that even though it harvests "free money", phishing only generated revenue equal to the costs incurred.

The research also claimed that survey-based estimates about phishing losses from the likes of analyst companies like Gartner were unreliable, because financial losses were estimated by averaging unverified and self-reported numbers.

The researchers said: "We estimate that recent public estimates overstate phishing losses by as much as a factor of 50."

Despite this, phishing remains a huge problem. In fact, the research went on to claim that the myth of the "infinitely capable superuser attacker" attracted many poorly-informed would-be phishing criminals, and polluted the internet with even more spam.

The researchers also said that although financial losses were smaller than speculated, there were many types of crime where the money gained by the criminal was small relative to the damage inflicted.

They said: "This appears to be the case with phishing. If the dollar losses were zero the erosion of trust among web users, and destruction of email as a means of communicating, would still be major problem."

Phishers have recently moved towards targeting social networks, such as Facebook and Twitter.