Phishing for data

I don't know about you but I receive a BUNCH of junk e-mail or SPAM. Nortel's filters keep much of the spam from getting to my Nortel e-mail account but I receive anywhere from 12 -30 spam a day in my roadrunner account. I receive a good amount in my Yahoo account as well but I really only use that for just that purpose, I give that e-mail address when I suspect an on-line vendor or service will sell my account to others. As a result I get more SPAM there but Yahoo's spam filters catch most of that and put it in the junk mail folder.

Anyway, forgetting all of the on-line Pharmacies, male enhancement, and mortgage company spam, recently I have been receiving some pretty scary things. The e-mail appear to be from companies like E-bay, or PayPal, CitiBank or other reputable companies, some of which I really have done business with. The emails have legitimate corporate logos and official sounding text usually informing me of a problem with my account that needs immediate attention. There is always a link to their web site to follow in order to address what ever issue being reported. To read the link text it indeed looks like it is going to take you to E-Bay or PayPal's web site. BUT if you look at the links actual URL address (the web page it will take you to) it points either to a web sight with a similar name OR some obscure web address.

These e-mails are what is called Phishing. The senders are phishing for personal data, credit card information, Account numbers, account passwords etc. The web sights will look very official and as you to log in. They might ask you to update your credit card information etc. If you give it to them... Well look for a trip to Mexico or Paris to show up on your next credit card bill.

I like to think I am smart enough not to fall for such a scam. So far I don't think I have jeopardized any sensitive personal information. But as these thieves become more and more clever It will become more and more difficult to distinguish the real from the fake, the good from the bad.

What can you do about it?

• Be suspect of ANY e-mail that comes into your mail box regardless who it is from. A cyber-thief can 'spoof' any e-mail address easily.
• If an e-mail contains a web-link, specially to some sort of financial or commerce site, do not click on it. If you are interested in the product or service, the cut and past the URL into your browser's address field or just type it in manually. Verify that when you actually open the web page that the final address matches or at least is similar to the one pasted or typed in. Sometimes Legitimate web sites redirect their web pages so this will not always be a red flag but if the resulting web address is ubiquitous then be-ware.
• If you receive a spoofed e-mail phishing for data. The best thing to do is to find REAL web page for the company being spoofed and they usually will have an 'online security' link that will provide an e-mail address that you can forward the offending e-mail to. This will help the company track down the offending parties. I have sent 3 so far this week.
  
• Finally if you are buying something online, try and find a phone number. If possible order the item's over the phone and give your credit card that way as opposed to filling in a web form. I don't do this always, specially if it is a company I have dealt with in the past like Barns and Noble etc. But after hearing some of the horror stories from co-workers and friends of stolen credit card numbers etc. I have started being MUCH more careful.

My geek lecture for the week.

Have a good week.


An Addendum to this post:
As I was writing this blog I received another spoofed e-mail. This time from "Citizens Bank"

Here is an example of the type of e-mail I am talking about:

Dear valued Citizens® Bank member,

Due to concerns, for the safety and integrity of the online banking community we have issued the following warning message.

It has come to our attention that your Citizens® account information needs to be updated as part of our continuing commitment to protect your account and to reduce the instance of fraud on our website. If you could please take 5-10 minutes out of your online experience and renew your records you will not run into any future problems with the online service. However, failure to confirm your records may result in your account suspension.

Once you have confirmed your account records your internet banking service will not be interrupted and will continue as normal.

To confirm your bank account records please click here.

Thank you for your time,
Citizens® Financial Group.

	Privacy | Security © 2005 Citizens Financial Group. All rights reserved. Terms of Use | Site Map

Now if you look closely at the URL in the "CLICK HERE" line it points to 'http://61.220.7736/CitizensBank/OnlineBanking/index.html'

This URL even look reasonable exept for the 61.220.7736 in the address.

All of the other link and images etc come directly from the citizen bank web site for instance the
logo at the top of the page comes from the URL 'http://www.citizensbank.com/img/header/cb_logo.gif' Even the web page style sheet comes directly from the legitimate Citizens Bank web site.

See what I mean. It is getting more and more difficult to determine the real from the fake. For me, this one was easy because I have no accounts with Citizen's Bank. Others may not be so lucky