| Copyright ©2003, part of The YKTA Corporation, and its licensor's. All rights reserved. |
How phishing operates
Phishers spam huge numbers of users with a seemingly credible e-
mail that instructs the user to visit a Web site (also fraudulent) where
they are prompted to enter or update their personal or private
information (such as passwords and credit card, social security, and
bank account numbers). Phishers also use pop-ups to try and scam
users into entering sensitive information.
What actually happens, to the trusting users who submit this
information in response to a Phishing attempt, is that identity thieves
steal the user’s information and their accounts are emptied.
Phishing attempts are extremely sophisticated and it can be
extremely difficult to tell if the e-mail or Web site is real. However, no
credible organization (like your bank, credit card company or social
security office) will ever ask you for those kinds of details in an e-mail.
Phishing got its name from the idea that bait is cast out among many
fish, some of which actually bite, become hooked and are reeled in.
There are several things to look out for regarding phishing attempts
Typical phishing e-mails will tell you that your account has come
under review, may be in danger of being suspended and/or
cancelled, and some piece of information needs to be verified or
updated, i.e.: your credit card number, bank account number, social
security number, or other personally identifiable data. Look for
phishing e-mails with spelling typos, i.e.: “Account Veerification
Request”, or characters in odd placement: “Requesting : Account :
Update”
When you think of phishing, think of fishing. Similar to how anglers
use bait to lure fish, online scammers use certain tactics to lure us
into giving them our valuable information under false pretenses.
Since information is so readily available to everyone via the Internet,
recognizing our online weaknesses will help us correct them.
What to do if you think you have been a victim of phishing
In the US
Government information:
If you believe you’ve been scammed, file your complaint at http://www.
ftc.gov/
If you receive spam that is phishing for information, forward it to
spam@uce.gov
In the UK
Government information
If you believe you’ve been scammed or you reveive spam that is
phishing for information, call Consumer Direct on: 08454 04 05 06
For all other countries try making a country specific search on
Google for: "phishing"
For example: http://www.google.com.au/ will let you search pages
just from Australia. We will add more information for other countries
as we compile it. If you can help with information, please contact us.
Partnering with your merchants and staying current on scams will
strengthen your knowledge and weaken the potential of becoming
prey to phishers. Remember, you do not need to become a victim in
order to stay informed!
Steps you can take to protect your personal data online and also,
what to do if you receive a phishing e-mail:
Do not reply to any e-mail asking to verify your personal data. You
will find that legitimate vendors and merchants do not send such
requests via e-mail.
Contact your merchant right away to ask for clarification of such e-
mails. (This will also make them more aware of the range of such
problems.)
Never divulge information, such as passwords and credit card,
social security, and bank account numbers, to anyone making
contact with you. Only give such information when you initiate a
service call, and only do so with trusted sources and where
appropriate.
Use anti-virus software and/or firewalls on every computer you
own/use. Remember that children are easy prey to the ‘just click
here’ tactic.
Stay up to date with current scams and always report suspicious
activity.
Identity theft is a fast-growing, serious crime
Identity theft happens both online and offline. One of the ways that
identity thieves collect personal and financial information about
members of the public offline, is to sift through carelessly discarded
trash. Many people throw bank statements, utility bills and other
potentially sensitive documentation away without shredding it first.
An identity thief can find enough about someone - just from their
dustbin or mailbox - to steal their identity. Identity thieves steal
personal and financial information online more purposely, with
phishing attempts for example - but it is often as a result of
carelessness and/or complacency, regarding personal and financial
information.
Identity thieves will steal your money from your accounts and
savings, run up enormous credit card bills, obtain passports and
other official documents, empty bank accounts - even using their ill-
gotten gains to fund other crimes, such as drug running and
terrorism. The legitimate owners of the information identity thieves
abuse can spend vast amounts of time and money trying to undo the
damage to their finances and their reputations.
Several clues present themselves when your identity has been stolen
Unexplained financial transactions and bills for purchases you know
you did not make.
Goods or credit cards that you did not order or apply for being
delivered.
Calls form debt collection agencies about goods or services that
you did not purchase.
Apparent redirection of mail, iike utility bills and other iimportant
correspondence.
You no longer have a good credit rating.
Repairing the damage - act as quickly as possible
Call law enforcement and report the identity theft. make sure you get
an incident number.
Report all lost or stolen documents, such as passports, driving
licences, credit cards, chequebooks.
Notify your bank, credit card company and any other financial
institution that holds you details. Tell them directly that you are
contacting them about identity theft. You will need to close any
accounts that have been compromised, which will be inconvenient
but will prevent an identity thief from stealing any more of your
money (assuming they have not already emptied your accounts).
Cancel your check books, credit and ATM cards and get anew PIN
[s].
Notify the postal service[s] if you think that your mail has been
tampered with or redirected.
Contact any companies where accounts have been opened in your
name and tell them that you are a victim of identity theft. they will
have apolicy in place to deal with your inquiry.
Contact the main credit bureaux and tell them that you have been a
victim of identity theft and ask them to monitor your credit activity.
Ask them to send you a credit report which, when you receive it,
study very carefully for discrepancies.
In the US
Government information:
If you believe you are a victim of identity theft, call the FTC's Identity
Theft Hotline toll-free on: 1-877-IDTHEFT (438-4338) or visit their
Identity Theft Web site.
Fill out the FTC's ID Theft Affidavit form to query/dispute and
unauthorized accounts that have been opened.
The FTC's Identity Theft Web site has lists and contact details for of
all of the organizations (like credit agencies) that you need to get in
touch with.
In the UK
Government information
If you believe you are a victim of identity theft, visit the Home Office
Identity Theft Steering Committee Web site
The Home Office Identity Theft Steering Committee Web site has
lists and contact details for of all of the organizations (like credit
agencies) that you need to get in touch with.
For all other countries try making a country specific search on
Google for: "identity theft "
For example: http://www.google.com.au/ will let you search pages
just from Australia. We will add more information for other countries
as we compile it. If you can help with information, please contact us.
Partnering with your merchants and staying current on scams will
strengthen your knowledge and weaken the potential of becoming
prey to identity thieves. Remember, you do not need to become a
victim in order to stay informed!
Precautions to take to minimize the risk of identity theft
Use passwords on all your accounts and change them regularly.
Don't leave your personal or financial information lying around your
home in plain view and buy a shredder.
Get a lock for your mailbox if it is outside your home and unsecured..
Don't keep your personal or financial information (including account
passwords) on your computer. Use removable storage
Don't give out personal or financial information on the phone,
through the mail, or online unless you are absolutely certain that your
contact is legitimate.
Don't respond (or at least if you do be very careful) to competitons,
promotions, surveys etc. They may be an attempt to steal your
details.
Never open e-mail and/or download attachments from anyone if you
are not expecting them and if you must open an attachment - always
virus scan it first, it could contain a security threat, like Trojan or
Spyware.
Always check the privacy policy of any Web site that requests
personal details. If the Web site is requesting this type of information
and does not have a privacy policy, it is not wise to submit your
information.
When submitting information online, make sure there is a "lock" icon
on the browser's status bar (and that it is "locked").
Keep your operating system, anti-virus, anti-spyware and firewall
software up to date.
Use any spam filters available by default from your ISP.
Run anti-spam software like Mailwasher.
Use anti-virus software and/or firewalls on every computer you
own/use. Remember that children are easy prey to the ‘just click
here’ tactic.
Stay up to date with current scams and always report suspicious
activity .