Phishing scammers are starting to use low cost VOIP (Voice over Internet Protocol) services to hoax users with fake automated call centres.

Typically phishers e-mail their victims, trying to lure them into revealing sensitive information on bogus Web sites. But instead of telling victims to click on a Web link, this attack asks users to verify account information on a phony customer support number.

"Part of the danger here is just the fact that it is novel," said Adam O'Donnell, senior research scientist with Cloudmark, an e-mail filtering company in San Francisco. "Most people are pretty comfortable calling a phone number that they think is their bank's."

To date phone phishing has not been widespread. Cloudmark first saw it in mid-April and the attacks only continued on a very limited scale for about three days. "It looks like a single scammer doing a proof of concept," O'Donnell said.

In total, Cloudmark intercepted about 1,000 VOIP phishing messages, a small number considering that Cloudmark's e-mail filtering service is used to filter mail for about 100 million mailboxes, O'Donnell said.

However, the attacks caught Cloudmark's attention because of its use of a telephone number, which was served by a small US-based VOIP carrier. This made them some of the first to leverage the cost savings of VOIP, O'Donnell said.

VOIP services are appealing because they allow customers to set up numbers anywhere in the globe. And because they can be combined with telephone software like the open-source Asterisk PBX (Private Branch Exchange) product, it can be inexpensive for thieves to set up a professional-sounding line.

"Getting a traditional phone number is high-cost," O'Donnell said. "With VOIP, the barrier to entry is significantly lowered."

Spammers have already been taking advantage of these low costs, using phone numbers instead of Web sites in their e-mail solicitations, but this was the first time Cloudmark had seen the approach used by phishers, he said.

O'Donnell declined to name the regional East Coast financial institution that was targeted in this attack.