Thieves steal €3m in carbon permits

An internet scam has relieved at least six German firms of €3m-worth of emission permits and caused some EU member states to temporarily suspend emissions trading.

However, the main European Emissions Exchange continued trading.

The criminals behind the theft used proven phishing techniques, creating fake emissions registries and genuine-looking emails to lure companies to a bogus website where they were persuaded to hand over security details giving the thieves access to their emission permits.

“Phishing scams are most often seen targeting consumers, requesting banking customers to reconfirm account information for example," said Phil D’Angio, director and online security expert at VeriSign "However, the concept is always the same and it’s no surprise that fraudsters targeted the lucrative business of emissions trading.”

The scam was global in scope with emails sent to companies from Norway to New Zealand. The crime has been reported to the public prosecutor in Berlin and the European Commission may also investigate.

"If [transactions] happened at national level, they are traceable. If they happened internationally, our Community registry will be involved as we can trace international transactions," an EC spokesperson told Reuters.

Phishing attacks can be countered with two-factor authentication processes, such as using an additional password sent to the mobile phone of the person submitting registration details, said D'Angio. "Two-factor authentication has been used successfully by the banking and retail sectors for some time now, and is a proven measure against phishing scams,” he added.