Carnegie Mellon University is researching the best ways to educate e-mail users about the dangers of phishing, such as how to distinguish the URL of a fraudulent Web site from a legitimate one. Not exactly rocket science…or is it?

The Pittsburgh-based university has scientists and graduate students working on research to determine, in essence, how to get through to e-mail users. Early results of a recent study show that users need to fall for phishing first in order to become aware enough to educate themselves against this form of fraud.

Another Ph.D. student at CMU took the time to develop an online game called Anti-Phishing Phil that goes into great detail about fraudulent sites and how to detect them. 

But clearly, not enough people are playing Anti-Phishing Phil.

How do we know that e-mail users are clicking on fraudulent URLs embedded in messages? Because spammers and phishers continue to send them. These guys don’t waste their time; if a spamming technique doesn’t work they move on to something that does. Clearly, embedding bogus URLs in spam messages and getting recipients to click on them is working.

Here’s an example from an e-mail I received today: In a so-called account confirmation spam that purported to come from Western Union (the sender’s domain is listed as westernunion.com), I was asked to click on an embedded link to confirm my account information with them, or it would be deleted. The fact that I don’t have a Western Union account was my first clue that this message was trying to send me to a site that would probably ask for some personal information and promptly steal it.

But what was even a bigger clue to me was the URL itself. I’m not sure what the site that it pointed to entails, and I don’t want to publish the URL because I wouldn’t want to be responsible for anyone else clicking on it, but it has the words `hotel,’ `bar,’ and `pub online’ in it; nary a mention of Western Union. Plus the domain suffix is `ch,’ for Switzerland; Western Union is based in Colorado.

According to a report issued today by PhishTank, a clearinghouse of information about phishing hosted by DNS service provider OpenDNS, phishing scams reported to the Web site in July were up 254% over the amount reported in January. That means there’s a lot of URL clicking going on.