Phighting phishing with a new top level .bank domain?

Most "older" people I know

Most "older" people I know have no idea what the address bar is let alone where to look for it. I tell them check out this website, and they open their broswer and type it in the default search engine, hoping it will show up. I have to explain, you need to turn on the address bar and actually type it in, I think its off by default in windows. They still don't know what I am talking about, never have actually typed in a web address, and wondering why their bank is asking them for their pin and ss#.

I have to echo the DNS

I have to echo the DNS server comments. It is too easy to compromise most DNS servers and once that is done setting up an alias takes no time.

From the time it is introduced until it was discovered and corrected a lot of damage could be done.

This is a nice thought, just not effective in the real world until all DNS servers are hardened and protected and monitored for unauthorized changes.

The premise of the of this

The premise of the of this suggestion is that the cost of registering a domain will keep phishers at bay. Unfortunately there's no good way to stop rogue or compromised DNS servers from being up long enough for phishers to harvest many bits of personal information.

One only has to look at the problem with spam. Today, the spec calls for all MTAs to have at least one MX record registered for the domain the mail is being sent from. There is no requirement to check if that sending host has a MX record, just its domain. That's why spam can be sent from machines with cable/DSL connections because the host comes from a domain that has an MX record. The problem is also compounded by the fact that many legitimate MTAs use pooled servers and often the mail is sent from a host that doesn't have an MX record.

To be honest - .bank would

To be honest - .bank would do nothing.

If the people getting phished would just LOOK AT THE ADDRESS OF THE WEBSITE before putting in their UN/PW/SSN/DOB/CC/CVV/EXP/etc..., there would be so few phishing attacks that it wouldn't be a profitable industry.

it doesn't matter if it's .bank, .com, or .identitytheft - there's always going to be a large portion of the population that is completely oblivious.

50,000? 500,000? All this

50,000? 500,000? All this cost to register a domain name? In case you are not aware, most of the US banks are not Bank of America. Most are small community banks which cannot afford this sort of short-sighted thinking. When your net revenue is less than 2 million/year, $50,000 is a huge amount to pay and 500,000 is nothing short of laughable.

I'm sure you wouldn't mind paying more in fees to cover these costs now would you? Would you at least make it a one-time fee? The large majority of people have no concept of the fees that banks already have to pay for mandatory compliance and you want to increase it by 50,000 or 500,000?

While patting yourself on the back for this "great" idea you will probably be grumbling about your service charges.

I am a Security Officer at a small community bank and I deal daily with people who have no trouble divulging their personal account information to anyone who comes along and asks for it. Then they get defrauded and wonder what happened. Even after they do this once some of them will do it again, at which point they will find themselves unbanked.

Just because you would make banks use the .bank domain name would not stop the phishing. People would still fall victim to it because they do not exercise common sense. You can't protect people from themselves.

US $500,000 registration and

US $500,000 registration and a guaranteed bond of $2.0 million backed by a registered agency bonding authority shoud deter copycats. Required, not optional: I'm liking this idea.