Spam does work
- IT TOPICS:Security
One of the fascinating things about spam is how it requires technical skill in gaming security systems followed by psychological skill in provoking human responses. A recent note distributed to the Security Metrics mailing list referred to an interesting study conducted by Laura Freider and Jonathan Zittrain titled Spam Works: Evidence from Stock Touts and Corresponding Market Activity. It shows the effectiveness of spam in spiking trading volume for a stock, with price fluctuations that are profitable for spammers and not-so-much for spammees.
The gist of the study is that spam e-mail touting a little known stock actually drives enough people to buy that the stock price moves. A spammer that invests before unleashing the stock-touting spam reduces the risks of market timing and direction of price movement, resulting in returns of approximately 5.79% in only 2 days. Not too shabby. Those people reacting to the spam find themselves buying as the price is rising, selling as the price drops after the spam campaign completes, and losing roughly 5.48% of their money. Not too good. The effectiveness of this ploy is evidenced by Sophos measurements which has seen stock spam explode from a mere 0.8% of all spam in January 2005 to a robust 15.0% of all spam by July 2006.
On the spammer side, it shows a level of sophistication and professionalism. With this approach, there are no traceable links to back-end systems required (unlike the “buy this product” or “give me your identity” scams) and spammers can use gained experience points to improve their message with the next touted stock. There really is not a ton of risk here if the spammers account for SEC laws that they disclose their financial interest in the message. It is designed to capitalize on the greed of recipients, and it works!
One the spammee side, it is the same old story to be cautious. It blows me away that people would actually put their money into play based on a stock tip received from an unknown source on the Internet. I guess there is no accounting for the gullible. We’ve said it many times before, but it is always a good to remind ourselves:
1. Don’t open, don’t read e-mail from people who you don’t know. No need to make yourself vulnerable to malicious code or temptations of offers too good to be true.
2. Don’t believe everything you read. Be sure you know that the author is reputable – the fact that your friend forwarded you the e-mail does not vouch for its authenticity.
3. Don’t act on what you read. If the above two points don’t stop you, please chicken out before tossing your hard earned money away.
Remember TINSTAAFL: There Is No Such Thing As A Free Lunch



