Sounds dodgy to me. Although could you guess that a bigpond.net.au address belongs to a wealthier person (except me) than say dodo.com.au?

Good question, Charles, and I don't think Gartner do a good job of explaining their assertion. In fact it doesn't seem that they have much of an idea themselves. This from a ZDNet piece (http://news.zdnet.com/2100-1009_22-6134224.html
Phishers chase the well-heeled):

"While we can't say phishers were targeting these people, we can say they did get more phishing e-mail than others," Gartner analyst Avivah Litan said. "It could be because of the lists they are on, which phishers find attractive. I've seen lists (on the Internet) where people are advertising platinum card holders' information."

Maybe it's just down to probability. I would guess that folk above the $100,000 threshold are more likely to use Internet banking, and more likely to move larger amounts of money around, and therefore are more likely to lose more money than those people who earn less.

But there's also a more intriguing possibility:
Phishers may be launching more focused attacks by matching their spam lists with information from stolen credit card lists (a business they're probably involved with anyway.) We've seen phishers target specific groups or individuals (spear phishing, in the argot) so perhaps this is just an outgrowth of that?

Some good points, Jeremy. I don't question the fact that on average, wealthier people lose more when their online accounts are attacked. Their daily credit limits are likely to be higher, for one thing.

And the growth of spear-fishing exploits indicate that the crooks are prepared to go to considerable trouble to target corporate sites, which offer much greater potential returns ... including perhaps customer details which could allow them to identify higher-income individuals. It's an interesting slant on Customer Relations Management.

I'd be very surprised, however, if more than a handful, if any of the 5000 US individuals Gartner surveyed had been identified in that way. That part of the survey is highly doubtful, in my opinion.

But you're quite right. There certainly is growing potential for the crooks to begin targeting specific individuals. If they did so, however, I suspect they'd try to hit them with trojans, rather than the hit-and-miss approach of phishing.

One data point, one of our users mentions that the specific address he used for ameritrade seems to be getting extra spamming attention.

http://www.emailaddresses.com/forum/showthread.php?s=&threadid=46421

Also some potential more detail here:

http://www.extremetech.com/article2/0,1697,2060277,00.asp

---
Another sign of the complexity of the operation, Stewart found, was a database hacking component that signaled the ability of the spammers to target its pump-and-dump scams to victims most likely to be associated with stock trading.

Stewart said about 20 small investment and financial news sites have been breached for the express purpose of downloading user databases with e-mail addresses matched to names and other site registration data. On the bot herder's control server, Stewart found a MySQL database dump of e-mail addresses associated with an online shop.
---

Rob