What is Phishing?
Phishing is a type of deception designed to steal your identity. In a phishing scam, a malicious person tries to get information like credit card numbers, passwords, account information, or other personal information from you by convincing you to give it to them under false pretences. Phishing schemes usually come via spam e-mail or pop-up windows.
How does phishing work?
A phishing scam begins with a malicious user who sends out millions of fraudulent e-mail messages that appear to come from popular Web sites or from sites that you trust, like your bank or credit card company. The e-mail messages, and the Web sites they often send you to, look official enough that they deceive many people into believing that they're legitimate. Believing that these e-mails are legitimate, unsuspecting people too often respond to the e-mail's requests for their credit card numbers, passwords, account information, or other personal information.
A scam artist might put a link in a fake e-mail that appears to go to the legitimate Web site, but actually takes you to a scam site or even a pop-up window that looks exactly like the official site. These copies are often called spoofed Web sites. Once you're at one of these spoofed sites or pop-up windows you might unwittingly enter even more personal information that will be transmitted directly to the person who created the spoofed site. That person can then use this information to purchase goods, apply for a new credit card, or steal your identity.
6 ways to protect yourself from phishing
Step 1: Never respond to requests for personal information via e-mail.
Legitimate organizations will never ask for passwords, credit card numbers, or other personal information in an e-mail. If you do receive an e-mail requesting this kind of information, don't respond -- Do Not Reply, Do Not Click on Links or Images in the Message, and Do Not Open any attachments with the message, If you think the e-mail is legitimate, contact the company by phone or through their Web site to confirm. See Step 2 for the best ways to get to a Web site if you think you've been targeted by a phishing scam.
You can get more information about phishing and see some example messages at SecureList Phishing Examples and Microsoft Safety & Security Center. You can also see actual phishing examples sent to Clarion University.
Step 2: Visit Web sites by typing the URL into your address bar.
If you suspect that an e-mail from your credit card company, bank, online payment service, or other Web site you do business with is not legitimate, don't follow the links to the Web site from an e-mail message. Those links may take you to a spoofed site that might send all the information you enter to the scam artist who created the site.
Classic examples are Phishing emails that claim to come from Ebay and Paypal. Pay attention to the URL of a web site. Malicious web sites may look identical to a legitimate site, but the URL may use a variation in spelling or a different domain (e.g., .com vs. .net). So BEWARE OF IMITATION WEB SITES!
Step 3: Check to make sure the Web site is using encryption
If you can't trust a Web site by the address bar, how do you know it's likely to be secure? There are a few different ways. First, before you enter any personal information, check to see if the Web site uses encryption to transmit your personal information. In Internet Explorer you can do this by checking the yellow lock icon on the status bar. If the lock is closed, then the site uses encryption. This symbol signifies that the Web site uses encryption to help protect any sensitive personal information-credit card number, payment details-that you enter.
Double-click the lock icon to display the security certificate for the site. The name following Issued to should match the site you think you're on. If the name differs, you may be on a spoofed site. If you're not sure whether a certificate is legitimate, don't enter any personal information. Play it safe and leave the Web site.
Step 4: Routinely review your credit card and bank statements
Review credit card and bank account statements as soon as you receive them to check for unauthorized charges.
Step 5: Report suspected abuses of your personal information to the proper authorities
If you feel you have been a victim of a phishing scam, you should immediately report the scam to the company that's being spoofed. If you're unsure how to contact the company, visit the company's Web site to get the correct contact information. The company may have a special e-mail address to report such abuse. Remember not to follow any links in the phishing e-mail you received. You should type the known Web site address for the company directly into the address bar in your Internet browser.
Step 6: Use Anti-virus Software and maintain security settings on your computer.
See the Safe Computing - Protect Your PC page for additional details.