Phishing, what is it, and how do you avoid it?
by MacTech
Phishing is a type of spam that attempts to get the reader to disclose their personal information and/or bank information to a fraudulent website, once the phishers have this information, they can run up unauthorized charges, drain your bank account or use your identity for criminal acts, or sell your identity to identity thieves, most commonly they take the form of a bank/credit card company/web merchant e-mail message asking you to update personal info for "security" reasons, or telling you that your account number has been stolen and you need to re-enter your personal/account info to allow them to "reset" your account
most phishing attempts have links to websites that look like the real thing, but are really the scammers site, where they harvest your account info and can then make fraudulent charges to your account, or sell off your identity to identity thieves
how do you recognize a phishing attempt?
first off, it's obvious if a bank you don't even have an account with is telling you your account is compromised, i.e. if you don't have an account with "ACME Cash-O-Matic Bank", and you get an e-mail that your <nonexistent> account is compromised, it's clearly a phishing attempt
second, banks will *never* ask for personal info in an e-mail, another sign of a phishing attempt
third, if you have the headers display turned on in your e-mail app, you can trace back where the e-mail came from, for example, if you have an account with the MegaCorp GalacticBank, and you get an e-mail from them telling you that your account has been compromised, the headers should show the e-mail as being sent from "megacorp.com", "megacorp.net", etc..., *NOT* "Joe-Bob's Bank And House of Ribs.com" or "Yeehaaa!.com"
unlike most spam attempts, where you should simply delete them and not respond, phishing attempts need to be brought to the attention of the company that's being fraudulently represented, as they tend to frown on fraud, especially if it's attached to their name, using the example above, you should go to the Megacorp GalacticBank webpage, find out the correct e-mail address to send the fraud attempt to (typically
fraud@megacorp.com, or
phish@megacorp.com) so they can investigate and prosecute the scammers, make sure you forward them the *entire* message, including the headers, that way they can track it down
the headers also contain the ISP ID that they used to send the scam out (Yeehaaa!.com in the above example), i'd also recommend sending the phishing attempt to the ISP's abuse department as well, most ISP's will pull scammers accounts, they don't want *their* company name associated with scammers either....
a couple more hints....
look for misspellings, somehow i don't think a Visa rep would write "attention valued visa custumer"
check the URL to see if it's a secure connection or a non-secure, secure connection URL's begin with https:// (note the s, signifying a secure connection), a https connection isn't a guarantee of a secure connection, as they can be faked, but it makes the chances of the email being valid a little more probable....
for example
https://visa is a little more legit than
http://visa, and both are more valid than
https://joebobsbankandhouseofribs, even though it has a (forged) security indicator
look for random letters at the top or bottom of the email, many times these random letters are disguised as an "encryption key" when all it is is a text block used to foil spam filter criteria
look for letter/number substitutions...
v1sa.com
visa.c0m
paypa1.com
paypal.c0m
check the destination address, if it has an @ symbol, most browsers ignore everything to the left of the @ symbol, for example;
https://megacorpbank.com@joebobsbankandhouseofribs.com/accountverify.html
the above URL has the https, signifying a secure location, it has the correct main URL, however it's still a phish, as the browser will redirect to Joe-Bobs Bank and House of Ribs (free fries with every checking account!, act now, supplies are limited) phishing site.....
remember, if it sounds too good to be true, or looks suspicious in any way, don't trust it.....
just for fun, click on the Megacorp link to see what happens, it's a fake link, but see where your browser tries to take you, does it try to take you to MegaCorp bank, or Joe-Bob's?
But I didn't click on the links but rather deleted it. Then I checked my paypal account and everything was normal. Whoever is running this needs to be tortured with Zardoc (sp???).
