Real or Fake--Can You Tell Phish
From Foul?
by Kellie Halder
Home & Family Finance Resource Center®
© 2005 Credit Union National Association Inc.
Logging on to the Internet connects
you to millions of people around the world, including scammers
phishing for your personal information. As phishing gets more
sophisticated it's becoming harder to tell the real from the fake in
your inbox. While nothing is foolproof, you'll avoid getting hooked
if you make sure your computer is secure and practice caution on the
Internet. And if you've been caught, there are steps you can take to
lessen your loss.
Phishing--A brief
history
Phishers use spam to lure people
into fake Web sites to obtain personal information to commit
identity theft. These criminals create and use e-mails and Web
sites--designed to look like e-mails and Web sites of well-known
legitimate businesses, financial institutions, and government
agencies--to deceive Internet users into disclosing their financial
institution and account information or other personal data such as
usernames and passwords.
During the beginning stages of
phishing it was easy to detect phony messages. Phishers often used
text-heavy e-mails laced with spelling and grammar errors. But
phishers have done their homework and improved their writing and
design skills, making it harder for you to make the call.
In fall 2003, phishers sent e-mails
containing logos and Web site designs stolen from the targeted
companies. The spoofed e-mails led consumers to believe the
message came from the company and divulge their information.
At the same time, virus writers also started targeting PayPal®
and eBay® users. E-mail recipients were asked
to update their billing and account
information and to give their Social Security number, date of birth,
and mother's maiden name on a spoofed Web site closely mimicking the
company's member services page.
The next wave of phishing came in
January 2004. Scammers designed Web sites redirecting victims
to the real home page of the targeted company, after the consumers
had divulged their information on a phishing site. This is a
common tactic still used today.
By April 2004 phishers discovered a
new way to trick victims using authentic-looking Internet addresses.
The new programming replaced the URL of the phishing site with the
one from the real site in the address bar. What had been one
of the easiest ways to detect phishing became much harder.
After sending phishing messages via
AOL's Instant Messenger, scammers started opening fake online
businesses by fall 2004. Fake online pharmacies, banks, and
mortgage-and-loan firms phished thousands of credit card numbers.
The most recent type of attack
involves keylogging. Once the phisher is inside your computer, he
implements code that records--logs--keystrokes when you visit
predetermined Web sites, often those of financial institutions. The
phisher then uses the key logger information to steal your identity.
Protecting
yourself
Phishing
attacks are changing all the time,"
says Patti Poss, attorney with the FTC's Bureau of Consumer
Protection. "It's best to protect yourself for the long haul," Poss
adds. Here are some tips to keep you safe:
Get your
computer ready
 | Never use
e-mail links to visit a Web site. Open a new browser window and
type the URL in the address bar. |
| Avoid
filling out e-mailed forms that ask for personal information. The
only way you should send credit card or account information is via
a secure Web site or by phone. |
| Be
cautious of urgent e-mails requesting personal information. Phony
e-mails usually include upsetting or exciting statements to get
people to respond. Phishers most often request user names,
passwords, credit card numbers, and Social Security numbers.
|
| Review
statements closely. Report any suspicious activity immediately.
Most financial institutions and online companies will reimburse
customers for any phishing activity. If your statement is late,
Poss advises you call the company to make sure your address has
not been changed. |
| Change
your passwords often. If your information is caught your passwords
will be out-of-date by the time they are sold to other phishers.
Experts recommend using passwords with a combination of letters
(upper and lowercase), numbers, and symbols. |
| Look for
clues you are connected to a secure site. An "https"--"s" meaning
secure--and a padlock indicate a secure connection. Click on the
lock to view the security certificate. |
You've been
phished--Now what?
Even the most tech-savvy people are
victims of phishing attacks. Despite being educated and prepared,
you still may be fooled into giving out your personal information.
"People often don't know it's phishing--they see the unauthorized
charge on their statement but don't relate it back to their Internet
activity," Poss says. If you've been phished, you should assume that
you'll probably become a victim of credit card fraud, bank fraud, or
identity theft. The following advice will help you if you've given
out sensitive information:
Credit, debit, or ATM (automated teller machine) card information
