Phishing

What Is Phishing?

“We suspect an unauthorized transaction on your account. To ensure that your account is not compromised, please click the link below and confirm your identity.”

“During our regular verification of accounts, we couldn’t verify your information. Please click here to update and verify your information."

Have you received email like this? Looks very official and scary, doesn't it? Makes you want to grab for your mouse and start clicking away on the link in the email? Don't! Chances are it’s a scam called “phishing”! It’s pronounced `fishing´ and simply put, it’s a scam to steal your credit card numbers, bank account numbers, Social Security number, passwords or other important private information. What happens in this kind of scam is the thieves will send you a very official looking email which usually says that if you don’t update your information, your account will be suspended or closed. Once at the site, you will be asked to provide bank account numbers, passwords, credit card numbers, etc. If you provide the information, you’re giving these thieves access to your savings accounts, checking accounts, credit card accounts, everything they need to steal everything you have including your identity.

How Do I Know If I’m Being Phished?

Raise your right hand and repeat after me, “My bank, credit card companies, Paypal, Ebay, Social Security Administration, or any other legitimate institution would never send me an email asking to send them private information in a return email”. Legitimate companies will notify you of problems by regular mail or via the secure site on their own server but they will not ask you to send private information in an email. If you’re in doubt, pick up the phone and call them.

There may be other clues like logos that don’t exactly match the company's logo, spelling errors, and @ signs in the link. Finally, don’t count on these clues being there, the only sure protection is to remember that no reputable company would ever send you this kind of message in an email.

What Should I Do If I Get a Phishing E-mail?

If you get an email or pop-up message that asks for personal or financial information, do not reply. Never click on the link in the email!!!!!!! Legitimate companies don’t ask for this information via email. If you are concerned about your account, contact the organization mentioned in the email using a telephone number you know to be genuine, or open a new Internet browser session and type in the company’s correct Web address yourself. In any case, don’t cut and paste the link from the message into your Internet browser — phishers can make links look like they go to one place, but actually send you to a different site.

Don’t email personal or financial information. Email is not a secure method of transmitting personal information. If you initiate a transaction and want to provide your personal or financial information through an organization’s website, look for indicators that the site is secure, like a lock icon on the browser’s status bar or a URL for a website that begins “https:” (the “s” stands for “secure”). Unfortunately, no indicator is foolproof; some phishers have forged security icons.

Use anti-virus and anti-spyware software, as well as a firewall, and update them all regularly. Some phishing emails contain software that can harm your computer or track your activities on the Internet without your knowledge.

Anti-virus software and a firewall can protect you from inadvertently accepting such unwanted files. Anti-virus software scans incoming communications for troublesome files. Look for antivirus software that recognizes current viruses as well as older ones; that can effectively reverse the damage; and that updates automatically.

A firewall helps make you invisible on the Internet and blocks all communications from unauthorized sources. It’s especially important to run a firewall if you have a broadband connection. Operating systems (like Windows or Linux) or browsers (like Internet Explorer or Netscape) also may offer free software “patches” to close holes in the system that hackers or phishers could exploit.

Review credit card and bank account statements as soon as you receive them to check for unauthorized charges. If your statement is late by more than a couple of days, call your credit card company or bank to confirm your billing address and account balances.

Be cautious about opening any attachment or downloading any files from emails you receive, regardless of who sent them. These files can contain viruses or other software that can weaken your computer’s security.

Forward spam that is phishing for information to spam@uce.gov and to the company, bank, or organization impersonated in the phishing email. Most organizations have information on their websites about where to report problems.

Notify the real company (not the one in the email). Most reputable companies want to know if their company name is being used to scam people. Report the email to the Anti-Phishing Working Group (APWG) at www.antiphishing.org. If your local authorities accept phishing scam reports, notify them. Once you’ve notified the company, the APWG, and the authorities, delete the email and empty your email trash so that you can’t accidentally click on the link.

If you believe you’ve been scammed, file your complaint@ftc.gov, and then visit the FTC’s Identity Theft website at http://www.ftc.gov/bcp/edu/microsites/idtheft/ Victims of phishing can become victims of identity theft. While you can’t entirely control whether you will become a victim of identity theft, you can take some steps to minimize your risk. If an identity thief is opening credit accounts in your name, these new accounts are likely to show up on your credit report. You may catch an incident early if you order a free copy of your credit report periodically from any of the three major credit bureaus. See www.annualcreditreport.com for details on ordering a free annual credit report.