Over the past few years, online banking and other Web-based financial services have exploded in popularity. As our lives have become more hectic the convenience and simplicity of online transactions have released us from standing in line and saved us much valuable time.
It was inevitable that the dishonest among us would notice our increasing use of the Internet and look for an opportunity to swindle and scam. The modern day 'rip-off merchant' uses social engineering to trick unsuspecting people into voluntarily giving away sensitive personal information such as credit card numbers, Social Security numbers, Personal Identification Numbers (PINs), and passwords with an ultimate goal of credit card or other monetary fraud, and identity theft. They may also use HTML e-mail and security vulnerabilities to download malicious software, such as Trojan Horses, onto victim computers.
In this column I will illustrate a few of the tricks that criminals use to try and convince us to trust them, reveal some of the ways that they hide their real identities, and provide information about how to help protect yourself from their harmful effects.
What is Phishing?
Phishing: creating a replica of an existing Web page in an attempt to fool a visitor into providing personal, financial, or password information.
The criminals responsible for phishing will send e-mail that claims to be from a legitimate business or government organization. The 'from' address will sometimes look legitimate but will often be fake.
The e-mail message may display pictures downloaded directly from the spoofed company's real Web site. If the company being imitated has sent e-mail in the past (for example, advertisements) the fraudsters will copy the format of the e-mail right down to the tiniest detail.
When a victim clicks on a false link in the e-mail message they are taken to a Web site that is an exact copy of a real business site. If there is more than one link in the message, several may go to a real business site, but the URL to be used to capture the victim's personal information will go to the fake site.
Below are some examples of what phish e-mail messages look like.
http://www.microsoft.com/library/media/1033/windows/ie/images/using/54304_fake_url_1.jpg
When we compare the URL in the message body of the e-mail (1) to the URL in the status bar (2) we can see that they are different.
http://www.microsoft.com/library/media/1033/windows/ie/images/using/54304_fake_url_2.jpg