Impacting phishers' margins is all we can do, really.
But it's something that we don't stomach. I wonder why. I suppose it's because the modern business-centric Internet is centered on the ability to scam people out of money. Investigations and enforcements would open the floodgates to every "normal" business too.
The real dent would be to get India (for US scammers) and Turkey (for German scammers) to cooperate, the way to do it would be to threaten devastating sanctions ("clean up your scammer scenes, or else"), but that cannot be done as it is important for geopolitical reasons to appease India (a significant portion of the world's pharmaceutical base compounds originate from there, not to mention the Ukraine conflict) and Turkey (same reason, Ukraine conflict + about 2 million Syrian refugees that Erdogan already abused as a political weapon once).
That's a feature. And the great thing of this feature is that it's opt-out. You can block connections from outside of jurisdictions you care about.
> To prevent this conversation from being painfully abstract, let’s scope it to one particular type of fraud against one particular type of actor: the bad guy steals a payment credential, like a credit card number, and uses it to extract valuable goods or services from a business. This is an extremely common fraud, costing the world something like $10 to $20 billion a year, and yet it is actually fairly constrained relative to all types of fraud.
> This fraud is possible by design. The very best minds in government, the financial industry, the payments industry, and business have gotten together and decided that they want this fraud to be possible. That probably strikes you as an extraordinary claim, and yet it is true.
Shhh, dont say the quiet part loud. The fact the internet is a pyramid scheme is supposed to be a "conspiracy".
A better term here would be "fringe theory", since it's unclear who would even be conspiring.
Phishers benefit from low domain prices because they can churn them faster than you can investigate them. Scams are fast, investigation slow.
Worse, you investigate only to find that the scammer is out of your jurisdiction (which I submit is the #1 problem with “enforcement”) and there is very little you can do. Also, if they can churn domains quickly, the thread that connects them is harder to find, so you only have the remnants of one or two scam domains where there may be hundreds more by the same perpetrator.
We normally settle on "have an anti-abuse team and charge money for domains to pay for them" as the least-bad option, but if you have a better idea I'm all ears.
If increasing the price hasn't decreased the abuse, why would increasing it more decrease the abuse?
It's all heavily automated, and I suspect there's some credit card fraud involved too. I also reckon there's a few unscrupulous registrars that are helping them.