What is phishing?
Phishing (pronounced "fishing") is a relatively new, but increasingly sophisticated way thieves steal personal information online. The scam involves the use of e-mail messages that appear to come from your financial institution or another trusted company you do business with, but are actually from imposters. The goal of the phishing message is to try and scam the recipient into surrendering private information that will be used for identity theft.
A typical phishing e-mail will ask you to click a link which takes you to a Web site, where you will be asked to enter personal financial information such as your username, account number, password or even Social Security number. Though these Web sites look and feel like the actual Web site, they are bogus and set up only to steal the user's information. Whatever data you enter into the imposter site can be used by thieves to gain control of your personal accounts.
Look for these warning signs to spot a phishing scam:
- Requests for personal information. Phishing e-mails usually try to get you to reveal personal or account information such as:
- Account numbers
- Credit card numbers
- Online usernames and passwords
- Mother's maiden name
- Social Security number
- Birthdate
- Other confidential information
- Claims of fraud or suspicious activity on your account. The e-mail message you receive may advise you that fraud or other suspicious activity has occurred on your account. You are then suggested to update, verify or confirm your personal or account information. If you don't, then access to your accounts may be suspended.
- Misspellings and poor grammar. Phishing emails often contain poor grammar and misspelled words.
- Web sites that are not secure. Sophisticated phishing scams include fake Web sites that look almost identical to the real one. Thieves have even been able to change the URL (e.g. www.websitename.com) that appears in address bar in the browser. Never reveal sensitive or personal information on Web sites that are not secure. (You will typically see a picture of a lock in the status bar at the bottom of your browser window when you are on a secure site.)
Tips to minimize your risk of being a victim of phishing:
As a reminder, we will never send you an e-mail that asks for your username and password, nor one that asks you to send us personal or sensitive information via e-mail.
If you receive a suspicious e-mail, simply delete it. Do not click on the link in the e-mail or even reply to it.
- Be suspicious of any messages that stress immediate action. A legitimate bank or business normally will not request personal information from you over an unsecured Web site or through e-mail. Messages that threaten to suspend or terminate your account if you do not reply quickly should be treated as highly suspicious. If you have doubts, call the business' customer service number to question the e-mail and the status of your account.
- Keep your computer software up to date. You install and keep updated anti-virus and firewall software programs to help keep your computer virus and ad-ware free.
- Type in the URL of the Web page you need yourself. Phishing scams rely on users to click on the links embedded in their fake e-mail to take you to fake Web sites. It's much safer to type the Web address directly into your browser yourself to ensure that you are visiting the legitimate site.
- Keep your password private. You shouldn't write down sensitive personal information such as your password or Social Security number. Try to change the passwords you use online frequently.
The FTC publishes a valuable guideline on its Website advising consumers on how not to get hooked by phishing scams. The FTC suggests these tips to help you avoid getting hooked by a phishing scam:
- If you get an e-mail or pop-up message that asks for personal or financial information, do not reply. And don't click on the link in the message, either. Legitimate companies don't ask for this information via e-mail. If you are concerned about your account, contact the organization mentioned in the e-mail using a telephone number you know to be genuine, or open a new Internet browser session and type in the company's correct Web address yourself. In any case, don't cut and paste the link from the message into your Internet browser — phishers can make links look like they go to one place, but that actually send you to a different site.
- Use anti-virus software and a firewall, and keep them up to date. Some phishing e-mails contain software that can harm your computer or track your activities on the Internet without your knowledge.
Anti-virus software and a firewall can protect you from inadvertently accepting such unwanted files. Anti-virus software scans incoming communications for troublesome files. Look for anti-virus software that recognizes current viruses as well as older ones; that can effectively reverse the damage; and that updates automatically.
A firewall helps make you invisible on the Internet and blocks all communications from unauthorized sources. It's especially important to run a firewall if you have a broadband connection. Operating systems (like Windows or Linux) or browsers (like Internet Explorer or Mozilla Firefox) also may offer free software "patches" to close holes in the system that hackers or phishers could exploit.
- Don't e-mail personal or financial information. E-mail is not a secure method of transmitting personal information. If you initiate a transaction and want to provide your personal or financial information through an organization's Web site, look for indicators that the site is secure, like a lock icon on the browser's status bar or a URL for a Web site that begins "https:" (the "s" stands for "secure"). Unfortunately, no indicator is foolproof; some phishers have forged security icons.
- Review credit card and bank account statements as soon as you receive them to check for unauthorized charges. If your statement is late by more than a couple of days, call your credit card company or bank to confirm your billing address and account balances.
- Be cautious about opening any attachment or downloading any files from e-mails you receive, regardless of who sent them. These files can contain viruses or other software that can weaken your computer's security.
- Forward spam that is phishing for information to spam@uce.gov and to the company, bank, or organization impersonated in the phishing email. Most organizations have information on their Web sites about where to report problems.
If you believe you've been scammed, file your complaint at www.ftc.gov, and then visit the FTC's Identity Theft Web site at www.consumer.gov/idtheft. Victims of phishing can become victims of identity theft. While you can't entirely control whether you will become a victim of identity theft, you can take some steps to minimize your risk. If an identity thief is opening credit accounts in your name, these new accounts are likely to show up on your credit report. You may catch an incident early if you order a free copy of your credit report periodically from any of the three major credit bureaus. See www.annualcreditreport.com for details on ordering a free annual credit report.
You can learn other ways to avoid email scams and deal with deceptive spam at ftc.gov/spam.
Fraud
Tips on how to prevent fraud online
- Make sure that the computer you use to access the Internet always has up-to-date versions of both anti-spyware and anti-virus software. Run scans often - at least weekly.
- Do not share your username, passwords or PIN's with anyone. If possible, try to use a different username and password for each of your online accounts.
- Install all security updates offered by your software providers. Most software vendors provide free patches to fix problems in their products. You can usually download these patches from the vendor's Web site.
- Do not send e-mails containing personal information that are not secured or encrypted.
- Verify that requests for your sensitive personal, financial, or account information are legitimate. Rarely do financial institutions request this type of data via e-mail.
Security Tips for Your Personal Computer
One of the most common ways that a thief can get personal information about you to commit identity theft is from your home computer. The following tips show you ways to minimize the risk of your personal information being accessed from your home computer.
Passwords and User IDs
For each computer or online service you use, you should have a unique user ID and password. Make sure it's something you can remember without writing it down. If possible, try to use a different username and password for each of your online accounts. Do not share the usernames or passwords with anyone.
You should avoid doing any of the following items when creating passwords for your online accounts:
- Using your name, nickname or initials
- Making your password the same as your user ID
- Using names of family members or friends that can be easily associated with you
- Using any consecutive keys on the keyboard, (e.g. QWERTY or FGHIJKL or 123456)
- Using all the same or repeating characters (e.g. CCCCCC or 999999)
- Using your telephone number, employee number or Social Security number
- Using dates that are easily associated with you such as your birth date
- Using names of family members or pets
Tips for creating strong passwords:
- Longer passwords are better than shorter ones (7 characters or more in length)
- Passwords should contain characters from at least 3 of the following categories:
- Upper case letters (A, B, C, ... Y, Z)
- Lower case letters (a, b, c, ... y, z)
- Numbers (0, 1, 2, 3, ... 9)
- Non-alphanumeric or special characters (e.g. punctuation marks or symbols)
- Passwords should be uniquely chosen for each and every site with you have an account.
Install anti-virus software on your machine and keep it up to date
Your home computer can become infected many ways: through e-mail, CDs, Web sites and downloaded programs or files. Anti-virus programs help protect your computer against most viruses, worms, Trojans and other "mal-ware" - the term used for programs that can make your computer act strange or perform poorly. Malware is bad for your computer because it is often used by thieves to perform malicious acts, such as accessing your personal data, deleting files, or using your computer to attack other computers. Having an anti-virus program installed on your machine is one thing. You should ensure that it is kept up-to-date and that is set to scan your machine at least weekly!
Only provide sensitive or private information during an encrypted session
Make sure that encryption is being used on a given Web page by looking for the icons pictured below in the lower portion of your browser (called the 'status bar'):
