Phishing

Sunday, January 31st, 2010 (No comments yet)

Phishing is an extension of an old scam where someone would call you pretending to be from your bank or the hospital and try to scare you into giving them information.

"Mrs. So-and-so, I'm Bill from the bank. Your account has been emptied and we're concerned that it wasn't actually you who did it. We can replace the funds, but we'll need to verify your identity. Please tell me your name, address, phone number, social security number, mother's maiden name, blood type, the time and duration of your last period (etc. etc.).

Here are some of the various types of phishing and what to do about them:

Account Phishing

Say a bad guy gets an e-mail from his bank warning of scams going around and to be careful not to fall for them. By copying the letter and just changing the end to list a link "for more information", he can easily have a very authentic looking e-mail to mass-distribute and hopefully con people with.

A fake e-mail...

...that leads to a fake website

Regardless of the form of the e-mail, the content tends to be very similar. Something's wrong with your account and you better log in quickly to find out what it is. The problem is that if you follow the link, the site you go to might look exactly like the real site, but it's actually a fake under the control of the bad guy.

Once you enter your name and password, you'll be redirected to the real site and will probably never realize that you just handed someone your login name and password. So when they told you that your account was empty, they were lying, but because you fell for their trick, soon it will be.

A phishing e-mail that's trying to get you to open an attachment. Don't fall for it!

Prevention

The simple solution is to never follow any link from an e-mail that claims to have come from your bank, your social sites, or anywhere else you have an account. Instead, open a browser window and go to that site or service directly (but make sure to use my search engine trick if you don't have it bookmarked). If the information in the e-mail about your "account being suspended" or whatever is true, you'll be able to find out by logging in normally or just calling the company.

The same goes if they want you to download an attachment, call a phone number, or make security changes to your computer. All of these can hurt you and help them if you don't verify the information before acting!

Spear Phishing

It's pretty easy to ignore an e-mail from a bank you don't even bank with. But what if the fake e-mail used your actual bank and addressed you by name? They might even refer to a recent communication you had with a real bank representative. Most people are far more likely to fall for a con that starts with authentic information.

Prevention

There are many ways bad guys can get that kind of data and you should do your best to prevent that, but the simple solution is the same as before:

When asked to call a number, follow a link, download a tool or attachment, or any other similar activity in an e-mail, just validate the message before acting on it!