. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Help prevent identity theft from phishing scams

Phishing with phones: the latest scam

Traditionally, phishing scams have used e-mail to direct potential victims to phony Web pages to steal their identities. Now, there's a new twist on phishing.

Instead of being directed to a Web page, you could be prompted to call a customer support number where a person or an audio response unit waits to take your account number, personal identification number, password, or other valuable personal data to steal your identity and access your account. Often the person on the other end of the phone line will make claims that your account will be closed or other problems could occur if you don't respond. Read on to learn how to avoid falling prey to this new threat.

Although law enforcement and other security agencies can trace phone numbers, perpetrators often use payphones, stolen cellular phone numbers, or hacked accounts, so it's important to avoid being conned rather than try to minimize damage afterwards.

Note: This scam may also take advantage of fax or VoIP (Voice over Internet Protocol) numbers as well.

Tips to help avoid being a victim of phone phishing:

Treat all unsolicited e-mail (and phone) messages with skepticism and avoid clicking on links.

Before you call, research unfamiliar area codes first using legitimate local phone companies to avoid long distance, international, or other toll charges.

To determine actual customer support and other phone numbers, check the organization's Web site. And when you do your research, don't follow a link in an e-mail—always type the Web site URL address yourself.

If available, refer to your hardcopy records of past invoices or statements for legitimate contact phone numbers and other information. Creditor customer support phone numbers are also often listed on the back of credit cards.

Stay current about the latest identity-theft scams through industry-standard security newsletters, security Web sites, and other reliable sources.

Scrutinize your e-mail for telltale signs of a phishing attempt, such as poor grammar, typos, strange Web addresses, or anything else that seems suspicious.

Report suspicious e-mail to the FBI, the Federal Trade Commission (FTC), and the Anti-Phishing Working Group (APWG).

What is a phishing scam?

Just when you thought it was safe to go back into your Inbox, there's a new form of spam e-mail on the horizon. This spam is more than just unwanted and annoying. It could lead to the theft of your credit card numbers, passwords, account information, or other personal data. Read on to find out more about this new identity theft scam and to learn how to help protect your privacy.

What is phishing?

Phishing is a type of deception designed to steal your identity. In phishing scams, scam artists try to get you to disclose valuable personal data—like credit card numbers, passwords, account data, or other information—by convincing you to provide it under false pretenses. Phishing schemes can be carried out in person or over the phone, and are delivered online through spam e-mail or pop-up windows.

How does phishing work?

A phishing scam sent by e-mail may start with con artists who send millions of e-mail messages that appear to come from popular Web sites or sites that you trust, like your bank or credit card company. The e-mail messages, pop-up windows, and the Web sites they link to appear official enough that they deceive many people into believing that they are legitimate. Unsuspecting people too often respond to these requests for their credit card numbers, passwords, account information, or other personal data.

What does a phishing scam look like?

As scam artists become more sophisticated, so do their phishing e-mail messages and pop-up windows. They often include official-looking logos from real organizations and other identifying information taken directly from legitimate Web sites.

The following is an example of what a phishing scam e-mail message might look like.

Example of a phishing e-mail message, including a deceptive URL address linking to a scam Web site

To make these phishing e-mail messages look even more legitimate, the scam artists may place a link in them that appears to go to the legitimate Web site (1), but it actually takes you to a phony scam site (2) or possibly a pop-up window that looks exactly like the official site. These copycat sites are also called "spoofed" Web sites. Once you're at one of these spoofed sites, you might unwittingly send personal information to the con artists. They then often use your information to purchase goods, apply for a new credit card, or otherwise steal your identity.

What to do if you've responded to a phishing scam!

You can do your best to prevent having your identity stolen by a phishing scam, but no method or system can guarantee total safety and security.

If you suspect that you've already responded to a phishing scam with personal or financial information or entered this information into a fake Web site, there may be ways you can minimize any damage.

Step 1: Report the incident

If you feel your personal information has been compromised or stolen, immediately report the circumstances to the following authorities:

Your credit card company, if you have given your credit card information.

This should be your first step. The sooner an organization knows your account may have been compromised, the easier it will be for them to help protect you.

The company that you believe was forged.

Remember to contact the organization directly, not through the e-mail message you received.

The IFCC.

The Internet Fraud Complaint Center (IFCC), a partnership between the FBI and the National White Collar Crime Center (NW3C), works worldwide with law enforcement and industry to promptly shut down phishing sites and identify the perpetrators behind the fraud.

The Federal Trade Commission.

If you believe that your personal information has been compromised or stolen, you should report the circumstances to the FTC: National Resource for Identity Theft and visit their site to learn how you can minimize any damages.

You can also report the phishing scam to the Anti-Phishing Working Group at reportphishing@antiphishing.org and to the FTC at spam@uce.gov. To report the scam to these groups, create a new e-mail message addressed to them and attach the phishing e-mail to the new message. You can also copy the entire phishing e-mail and paste it in the new message. Do not use the "forward" option if possible, as this format may exclude information and requires more manual processing.

Step 2: Change the passwords on all your accounts

If you think you've responded to a phishing scam with password information or entered passwords into a phony Web site, change your passwords as soon as possible. For more information, see Creating stronger passwords.

Step 3: Routinely review your credit card and bank statements

If you review your bank and credit card statements at least monthly, you may be able to catch the con artists and stop them before they cause significant damage.

Step 4: Use up-to-date antivirus and anti-spyware software

Some phishing e-mail may contain malicious or unwanted software that can track your activities or simply slow your computer. To learn more about this type of unwanted software, such as viruses and spyware, read:

An introduction to computer viruses

What is spyware?

For a more detailed list of steps you can take if you feel you've been victimized, see What to do if you're a victim of fraud.

How can I tell if an e-mail message is fraudulent?

The following are just a few phrases to watch for if you think an e-mail message is a phishing scam. Don't forget to trust your instincts. If an e-mail message looks suspicious, that probably means that it is.

Tip:  If you believe you may have already provided personal or financial information in response to an e-mail message that looked like one of these examples, read What to do if you've responded to a phishing scam.

"Verify your account." Businesses should not ask you to send passwords, login names, Social Security numbers, or other personal information through e-mail. Be suspicious of a message that asks for personal information even if the request looks legitimate.

If you receive an e-mail from Microsoft asking you to update your credit card information, do not respond to this phishing scam. To learn more, read Fraudulent e-mail sent to Microsoft customers.

"If you don't respond within 48 hours, your account will be closed." Phishing e-mail may be polite and accommodating in tone, but these messages often convey a sense of urgency so that you'll respond immediately without thinking. Phishing e-mail may threaten to close or suspend your account or may even say your response is required because your account may have been compromised.

"Dear Valued Customer." Phishing e-mail messages are usually sent out in bulk and do not contain your first or last name. Although, it is possible that con artists have this information. Most legitimate companies (but not all) should address you by first and last name.

"Click the link below to gain access to your account." HTML-formatted messages can contain links or forms that you can fill out just as you'd fill out a form on a Web site. The links that you are urged to click may contain all or part of a real company's name and are usually "masked," meaning that the link you see does not take you to that address but somewhere different, usually a phony Web site. Notice in the following example that resting the mouse pointer on the link reveals the real Web address, as shown in the box with the yellow background. The string of cryptic numbers looks nothing like the company's Web address, which is a suspicious sign.

Example of masked URL address

Another common technique that con artists use is a Uniform Resource Locator (URL) that at first glance appears to be the name of a well-known company but is slightly altered by intentionally adding, omitting, or transposing letters. For example, the URL "www.microsoft.com" could appear instead as:

www.micosoft.com
www.mircosoft.com
www.verify-microsoft.com

Microsoft won several lawsuits against individuals who have used these types of URLs to pose as legitimate Microsoft properties. However, the practice remains pervasive, so be aware of this technique.

To learn more about how to handle suspicious e-mail, read The dos and don'ts of dealing with suspicious e-mail.

Sources:
http://www.microsoft.com/athome/security/default.mspx
http://www.microsoft.com/athome/security/email/phishing.mspx