Should it surprise us that the IM waters are getting clouded by phishers? [a phisher is someone who sends out a legitimate-looking message that tries to trick people to go to a spam site, or, worse, to give away their financial information or to download viruses or worms.]

John Dickinson of Messaging Pipeline points to the increased trends of phising on IM’s. He argues that IM’s are vulnerable to phishing not because of security issues, but to the “vulnerability and naivet of users.” Why is this? Many users accept messages from strangers – after all, many IM’s used as a way to meet new people to begin with. So, if a user accepts the message, there is a greater likelihood that the link will be clicked – leading the user to spam and phishing sites. At least with email there are junk filters to stop you from being exposed to the message – this is not so in this scenario.

So, why would anyone click on the link anyway? Well, people do. According to a recent study, as many as 10% of people buy spam products, and over 30% of people click on spam and phisher links. Although these stats were for email, you can imagine it being the same, if not higher, for IM. I would perhaps think that IM’s have that “trust” environment going for them, making users more likely to accept links and click on them.

So, when will spim-blocking get serious for IM’s?

As far as I can tell from talking to vendors like FaceTime, Akonix, and IMLogic, not enough of you have taken advantage of those systems, and your employees remain vulnerable to all sorts of IM security breaches.

There are usually options within IM’s to increase privacy – not accepting messages from people you don’t know, being asked when added to contact lists, etc. I have noticed in MSN, I cannot receive links from people unless another non-link message is sent first. Don’t know if this is a spim block, but it is effective. Overall, it would seem IM’s are vulnerable to spim because people let their guard down in the IM environment. Spim-block software will need to be build around the realization that people may want to receive unsolicited messages – just not necessarily spim.