How to Avoid Phishing Scams

Watch out for these sneaky scams that try to trick you into giving your personal information to crooks

Email Phishing Scam Methods

1. Subject Lines
   
   Phishing emails always have subject lines that appear to be genuine. I will seem to be really legitimate as it will relate to who the email is from and the content of the email will tend to corroborate it. The more interesting they can make the subject line the better. Their goal is to get you to open the email and read it. For example, subject lines like this: !Important notice to all PayPal users!. It is also common for subject lines to carry numerals or other letters to replace characters, in an attempt to bypass SPAM filters, such as capital ? I ? replacing ? l ?. Some phishing emails will deliberately misspell key words to bypass SPAM filters, which most people would not recognize when quickly glancing at the subject line.
2. Disguised return email address
   
   It is very easy for the professional criminal to forge the senders email address. There is no guarantee that the address listed as the senders address is genuine. Phishing scam emails will normally have a false return address it will look like it is from the company it is claiming to be.
3. Website Content and Layout is copied
   
   Many consumers are fooled into thinking an email is genuine because it has the banks logo in it. Some phishing emails also have genuine links to the company's privacy policy and other pages on the legitimate web site. Phishing emails always seem to use copied images and text styles used on the legitimate web site fool the consumer into believing that their email is genuine.
4. Hyperlink Manipulation
   
   Links within an email are deliberately disguised in another attempt to deceive the recipient. HTML emails may display a genuine URL but when clicked on the hyperlink will take the user to a different web site. For example: http://www.win-big-bucks.com? may actually take the user to the web site the scam artists wants you to go.
   
   The consumer needs to be very careful with these hyperlinks. Even if the legitimate companies URL seems to be in the web address it may not go to that site. These new hi-tech outlaws are very manipulative and are experts at deception.
5. Forms (Surveys, etc.)
   
   The email may contain a form for asking you to enter some personal information and and send it to them. It can take on may different forms to try to entice the consumer into giving them sign on ID's and pass words or worse yet a persons date of birth, social security number, mother maiden name or account numbers. These methods are used by the more complex phishing emails. Some amateur phishing emails may contain poor spelling & grammar, no images and may not even attempt to disguise the URL.

1. Genuine Looking web site
   
   The fake web site will have copied text and images from the genuine site and the scam artist has no trouble doing this as it is an easily accomplished procedure. It is very easy to manipulate the web site to their advantage. Who wouldn't sign into their normal legitimate third party payment web site, or on-line banking web site? This is a scary situation if a consumer falls for this trick and furnishes personal information.
2. Similar looking URL
   
   Some fraudulent web sites can have similar but different domain names that are similar to the genuine site they want the consumer to believe they are at. Scam artists can manipulate the web browser to not reveal the URL line so you will not even be able to see what site you have signed onto. This is smoke and mirror deception in the hi-tech world and is easily accomplished.
3. Web Forms
   
   The easiest way to collect information in web site phishing scams is to use forms on the fraudulent site. In many cases it will be the same form that is normally displayed on the genuine web site. This may be an at a third party payment site, or a detailed form for verification of personal details such as date of birth, social security number, mothers maiden name or an account number.
4. More on URL manipulation
   
   Some phishing scams web will display only an I.P addresses in the URL field of the internet browser, the consumer will only see numbers in the URL address bar. The hi-tech world today is so complex that most consumers do not realize that there are a lot of methods that can be used to deceive them and these can include JavaScript, HTA and some HTML which can easily disguise address bars and even construct one that looks real but it only showing the consumer what they want to see. Those are just some of the techniques that can mislead the unsuspecting and trustful individual. The consumer can disable active X and java script in the internet browser setting but this will lead to a less enhanced experience on the world wide web and many web site are using JavaScript and other active X functions.
5. Pop up Windows
   
   The web site that the consumer was routed to could also just be a bare pop up window with no address bar, tool bars, status bar or scrollbars. It will be opened in the foreground to display the fake webpage. This, of course, is designed as an attempt to mislead the consumer into think it is directly associated to the genuine page.
6. Address bar manipulation
   
   this involves the placement of a text object with a white background over the URL in the address bar. The text object contains the fake URL, and this covers the real URL the consumer was directed to. Again, you can stop this by disabling Active X and JavaScript in browser settings. Most web pages utilize these tools and it could be impractical to disable them.
7. Pop up Window
   
   This form of deception involves the use of script to open a genuine webpage in the background while a bare pop up window (without address bar, tool bars, status bar and scrollbars) is opened in the foreground to display the fake webpage, in an attempt to mislead the user to think it is directly associated to the genuine page. This method also utilizes scripts, and can be stopped by disabling Active X and JavaScript in your browser settings.
8. Spy Ware and Trojan Horses
   
   Trojan Horses and worm viruses are sent as an email attachment, and if opened will install an attached software program. The attachment is a program that exploits vulnerabilities in Internet Browsing software that can force a download from the Internet. This file will download other files and codes, which when installed will run a fully functional Trojan virus.
   
   The Trojan Horse is designed to search for personal information, ID's and passwords, which many people keep on their computer. This information is then sent to a database to be use at any time by the scam artists.
   
   Spy ware, such as keyboard loggers, capture information entered at legitimate web sites, such as third party payment sites and then it sends this information to the scam artists.

How to Avoid Phishing Scams

• Be suspicious of any email with urgent requests for personal financial information unless the email is digitally signed, you can't be sure it wasn't forged or 'spoofed.'
  
  Phishers typically include highly reactive statements in their emails to get people to respond immediately. They typically ask for information such as usernames, passwords, credit card numbers, social security numbers, etc.
• Don't use the links in an email to get to any web page, if you suspect the message might not be authentic. Instead, log onto the website directly by typing in the Web address in your browser.
• Avoid filling out forms in email messages that ask for personal financial information. You should only communicate information such as credit card numbers or account information via a secure website. To ensure you're on a secure Web server, check the beginning of the Web address in your browsers address bar - it should be "https://" rather than just "http://"
• Check your online accounts frequently by logging into them. In this case, frequently is a minimum of monthly.
• Make it a routine to always check your bank, credit and debit card statements to ensure that all transactions are legitimate. If you see any suspicious charges or transactions, contact your bank and all card issuers for more information and guidance to correct the situation.
• Make sure that your browser is up to date and that all security patches have been installed.
• Always report "phishing" or "spoofed" e-mails to the following groups:
  • Forward the email to the Federal Trade Commission at spam@uce.gov
  • Forward the email to the "abuse" email address at the company that is being spoofed (e.g. "spoof@ebay.com")

More Fraud Guides Phishing Information