|
Things you
should know to about phishing scams |
|
|
It is becoming increasingly
common to tune in to the news or load your
favorite news website
and read about yet another Internet
e-mail
scam. An e-mail
scam is a fraudulent e-mail
that appears to be from a legitimate Internet
address
with a justifiable request — usually to
verify your personal information or account
details. One example would be if you received
an e-mail
that appears to be from your bank requesting
you click a hyperlink
in the e-mail
and verify your online banking information.
Usually there will be a repercussion stated in
the e-mail
for not following the link,
such as "your account will be closed or
suspended." The goal of the sender is for
you to disclose personal and/or account
related information. This type of e-mail
scam is also called phishing.
How to Spot A Phishing
Scam
At first glance, it may not be obvious to the
recipients that what is in their inbox is not
a legitimate e-mail
from a company with whom they do business. The
"From" field
of the e-mail
may have the .com address
of the company mentioned in the e-mail,
and the clickable link
may also appear to be taking you to the
company's website,
but will in fact take you to a spoof website.
Looks can be deceiving, but with phishing
scams the e-mail
is never from whom it appears to be!
The image below is a
screen-shot of an actual scam email.
Highlighted are three key components of the
message. The most important thing to remember,
however, is that a legitimate company with
which you do business will NEVER
request account information in this manner. |
|
 |
|
Phishing
e-mails
will contain some of these
common elements:
1. The "From" field
appears to be from the
legitimate company mentioned in
the e-mail.
It is important to note,
however, that it is very simple
to change the "from"
information in any e-mail
client.
While, for obvious reasons, I'm
not going to tell you how, rest
assured it can be done in a
matter of seconds!
2. The e-mail
will usually contain logos or
images that have been taken from
the website
of the company mentioned in the
scam e-mail.
3. The e-mail
will contain a clickable link
with text suggesting you use the
inserted link
to validate your information. In
the image you will see that once
the hyperlink
is highlighted, the bottom left
of the screen shows the real website
address
to which you will go. Note that
the hyperlink
does NOT point to the legitimate
Citibank website
URL.
In this instance the the text
you click is "here",
however this may also state
something like "Log-in to
Citibank" or "www.citibank.com/secure"
to be even more misleading. This
clickable area is only text and
can be changed to anything the
sender wants it to read.
Additionally, you may spot some
of these elements that did not
appear in this particular scam:
Logos that are not an exact
match to the company's logo,
spelling errors, percentage
signs followed by numbers or @
signs within the hyperlink,
random names or e-mail
addresses
in the body of the text, or even
e-mail
headers
which have nothing to do with
the company mentioned in the e-mail.
|
|
|
|
|
Who Is Behind the Phishes
& Why
The people behind phishing
e-mails
are scam artists. They literally send out
millions of these scam e-mails
in the hopes that even a few recipients will
act on them and provide their personal and
financial information. Anyone with an e-mail
address
is at risk of being phished.
Any e-mail
address
that has been made public on the Internet
(posting in forums, newsgroups, or on a website)
is more susceptible to phishing
as the e-mail
address
can be saved by spiders
that search the Internet
and grab as many e-mail
addresses
as they can. This is why phishing
is profitable for scammers; they can cheaply
and easily access millions of valid e-mail
addresses
to send these scams to.
Phish
Sense
Hopefully after reading this far, you will be
able to spot a phishing
e-mail
without too much difficulty. The e-mail
represented above is just a sample; phishing
e-mails
can appear to be from any bank, PayPal, eBay,
credit card companies, an online retail store
— basically from anywhere a person may have
registered for an account, and usually would
have supplied financial information when
registering.
The golden rule to avoid
being phished
is to never ever click the
links
within the text of
the e-mail.
Always delete the e-mail
immediately. Once you have deleted the e-mail
then empty the trash box in your e-mail
client
as well. This will prevent
"accidental" clicks from happening
as well. If, for some really odd reason you
have this nagging feeling that this could just
possibly be a legitimate e-mail
and nothing can convince you otherwise, you
still need to adhere to the golden rule and
not click the link
in the message. For those truly worried that
an account may be in jeopardy if you do not
verify your information, you need to open your
web
browser program
of choice and type the URL
to the website
in the address
field
of your browser
and log on to the website
as you normally would (without going through
the e-mail
link
as a quick route). This will provide you with
accurate information about your account and
allow you to completely avoid the possibility
of landing on a spoof website
and giving your information to someone you
shouldn't.
Now that you know how to avoid
being phished,
there is still the question of what to do
about phishing
e-mails
should you be a recipient of them. First of
all, you can visit the website
of the company from whom the e-mail
appears to be from and take the time to notify
them of the suspicious e-mail.
Many companies do want to know if their
company name is being used to try and scam
people, and you'll find scam and spoof
reporting links
within some of these websites.
Additionally you can report phishing
to the Federal Trade Commission, FTC, (here),
and depending on where you live, some local
authorities may also accept Internet
phishing
scam reports. Lastly, you can also send
details of a phishing
scam to to the Anti-Phishing
Working Group (here)
who is building a database
of common scams to help inform people of the
risks.
|
|
|
Did You Know...
The word phishing
comes from the analogy that Internet
scammers are using e-mail
lures to fish for passwords and financial data
from the sea of Internet
users. The term was coined in 1996 by hackers
who were stealing AOL Internet
accounts by scamming passwords from
unsuspecting AOL users. Since hackers
have a tendency to replacing "f"
with "ph", the term phishing
was derived.
|
|
|
|
|
|
|