Be Aware of Phishing Scams!

If you use emails actively in your communication, you must have received various messages claiming to be from Ebay, Paypal and a number of banks. A recent email as if from U.S. Bank Corporation that I received contains the subject "U.S. Bank Fraud Verification Process" and in the body of the mail it says "We recently reviewed your account, and suspect that your U.S. Bank Internet Banking account may have been accessed by an unauthorized third party. Protecting the security of your account and of the U.S. Bank network is our primary concern. Therefore, as a preventative measure, we have temporarily limited access to sensitive account features. To restore your account access, please take the following steps to ensure that your account has not been compromised:". It continues with a link to a webpage, which looks very similar to original web page of the bank.

The misleading web site appears authentic with familiar graphics and logos. The wordings are professional right down to the legal disclaimer at the bottom of the page.

If you happened to be holding an account of the claimed bank, followed the instructions of the email and input your account, pin, password, etc. you are doomed. You just have handed over access to your account to a con artist, who, in a matter of days, will drain off all the money available in that account.

This new scam, which is proliferating in a very rapid pace, is called "Phishing". Phishing is a form of identity theft, where a con artist with the help of official looking email containing link to phony web pages capable of harvesting information, tricks an unsuspecting victim into divulging sensitive personal data. Scammers use these data to bilk victims out of their savings.

One of the most common phishing campaigns being waged has targeted users of Web auction giant eBay and its PayPal division with financial services giant Citibank serving as another popular target. However, recently, every major bank has been hit with this scam. Crooks send out huge amounts of emails with an expectation that some of these email address owners may have online access to their accounts at the bank.

The term "Phishing" is a deviation of the word "Fishing". In hackers’ lexicon, in many words, "F" becomes "Ph". The term derives from the fact that scammers use sophisticated bait as they "fish" for users’ personal information.

According to Gartner, a research firm, illegal access to checking accounts gained via phishing has become into the fastest growing type of consumer theft in the United States. Roughly 1.98 million people reported that their checking account was breached in one way or another during the last year and US$ 2.4 billion were defrauded from the victims!

Gartner also estimated that 57 million U.S. Internet users have received phishing emails and 3 percent of them may have fooled into revealing their personal sensitive information.

The Anti-Phishing Working Group has also spotted a dramatic increase in reports of phishing attacks in recent months. Since November, 2003 phishing scams increase by about 110 percent each month. In April alone, the group identified 1125 unique phishing scams, a sharp lift of 178 percent from the previous month.

MessageLabs, a company that watches phishing scams closely, has noted an even more dramatic increase in number of phishing emails. It claims to see phishing messages jump from just 279 in September, 2003 to a staggering 215,643 in March of 2004.

The scammers also started to use more sophisticated technologies in recent months. The latest generation of phishing scammers uses several methods to trick users, including pop-up graphics to mast the true web URL of the phishing site and the installation of Spywares and Trojans on victim’s computer. The perpetrators also take advantage of security bugs in web browsers, in which the URL in the address bar appears to be for one site but is, in fact, a link to a totally different site.

A new Windows worm under the name "Korgo" is able to infiltrate into victim’s system with a key logging Trojan, steal information that the victim input in web forms and secretly transmit to designated server. There are a number of variants of this worm and they are spreading rapidly. However, Microsoft in April came up with a patch to seal this glitch. Many computers without the patch are still vulnerable to this potentially dangerous worm.

A U.S. Treasury report provides consumers with steps to prevent and report phishing scams:

• Do not respond to or open any e-mail that warns that an account is about to be closed. Contact the company directly by phone and inquire of this e-mail.
• Do not submit financial information unless there is a symbol for a locked padlock on the browser's status bar. Also look for the https:// at the beginning of the Web address. If both of these signs are absent, the Web site is not secure.
• Always review your bank statement and credit card statements immediately upon receipt.
• Verify the domestic telephone number listed on the Web site through directory assistance or other reliable sources and call the number. Many phishing attacks have originated outside the U.S. and don't have a domestic number.
• Report suspicious activity or if you have been defrauded to the FTC and the FBI.
• Phishing e-mails can be forwarded to uce@ftc.gov. Complaints can be filed at www.ftc.gov. Phishing attacks can also be reported to the Internet Fraud Complaint Center at www.ifccfbi.gov.

Other cautionary measures you should take in order to protect yourself are:

• Since most of the phishing emails come through spam, get a spam filter and install on your computer.
• If you suspect a phishing attempt, report immediately to the bank. Every bank web site has a link or a toll-free number to report scams. Don't be ashamed if you were tricked into divulging account information. If you report it immediately, your account will be protected until you receive a new PIN.
• Change your password and PINs regularly. Banks advise that you use separate PINs and passwords for different accounts, that way if one gets compromised, your entire financial life won’t be revealed. - If you are a frequent user of EBay, download its Web browser toolbar, a small program that runs with a user's Web browser. It flashes red when the user visits a possible spoof site. The toolbar uses a database of spoof site URLs, submitted by customers and is updated quite often.
• Check your computer frequently for possible Trojan virus.

Internet Security Basics 101

The explosive growth of the Internet has meant that thousands of people are today experiencing the joys of being online for the first time. With growth there always comes pain. Be it your growing pains as a child or the growth and development of this part of our culture called the Internet.

Firstly we need to quickly explain what the Internet is and where it came from. The Internet is the offspring of a military project called Arpanet. Arpanet was designed to provide reliable communication during global nuclear war. A vast network of interconnected computers was set up all over the world to allow the various branches of US and NATO forces to communicate with each other.

Nuclear war never came (thankfully) and the world was left with a massive network of computers all connected together with nothing to do. Colleges and universities started to use these computers for sharing research internationally. From there it grew and spread outside colleges to local homes and businesses. The World Wide Web was born and its father was a guy called Tim Berners Lee.

When you're connected to the Internet you're sharing a vast network with hundreds of millions of other users. This shared network provides resources that 15 years ago were never thought possible. Unfortunately when something is shared its open to abuse. On the Internet this abuse comes from hackers and virus creators. Their sole intent is to cause chaos and/or harm to your computer system and millions of other computer systems all over the world.

How do you combat this? You need an Internet security system. This might sound complicated but your Internet security system will be quite straigtforward being comprised of just 2 - 3 Internet security products. We'll look at each of these products in more detail now:

AntiVirus Software

The first and most critical element of your Internet security system is antivirus software. If you don't have up-to-date antivirus software on your PC you're asking for trouble. 300 new viruses appear each month and if you're not constantly protecting your system against this threat your computer will become infected with at least one virus - it's only a matter of time.

Antivirus software scans your PC for signatures of a virus. A virus signature is the unique part of that virus. It can be a a file name, how the virus behaves or the size of the virus file itself. Good antivirus software will find viruses that haven't yet infected your PC and eliminate the ones that have.

Antivirus software can only protect your computer from viruses trying to infect it via email, CD-Rom, floppy disk, Word documents or other types of computer files. Antivirus software alone will not keep your computer 100% safe. You also need to use firewall software.

Firewall Software

The use of firewall software by home computer users is a relatively new occurence. All Internet connections are a two way process. Data must be sent and received by your computer. This data is sent through something called ports. These are not physical things rather aspects of the way your computer communicates online.

Firewall software watches these ports to make sure that only safe communication is happening between your computer and other computers online. If it sees something dangerous happening it blocks that port on your computer to make sure your computer stays safe from the person who is trying to hack into your system.

An easier way to understand a firewall would be to picture your computer as an apartment complex. At the front door of this complex there is a security guard. Every person who enters the complex must pass this security guard. If the security guard recognizes the person entering as a resident he allows them to pass without saying anything. If, however, the person entering the complex is unknown to him then he will stop that person and ask for identification. If they have no business being at the apartment complex he escorts them from the building.

If you are not currently using firewall software your computer will get hacked into - that's a guarantee.

PopUp Blocker

You can get a good popup blocker at no cost. An easy way to do this is to install either the Google or Yahoo toolbar. Both of these come with popup blockers built in. Popups are not necessarily dangerous but are a nuisance and using either of these toolbars will make your life that bit easier.

A simple rule for practicing online security is: "If in doubt then don't". If you don't recognize the file, the email address, the website or if your gut feeling says "no" then don't click that button.

7 Ways to Protect Yourself Online

Based on information provided on the Internet World Stats website, there are about 1.3 billion internet users worldwide. Some of these users are friendly people who want to enjoy entertaining themselves, communicating with friends and family, or researching and shopping. There are others who may be conducting business online and there are stil others who are there to harm your computer.

The Internet can be a great place to do a lot of great things, but special care should be taken to make sure conditions are as safe as possible.

Here they are:

1) Scan for viruses - It doesn't matter as much about what program you are using as it does how often you use it. Having the best virus software and never using it is about as bad as having no software at all. Computers can become infected in a number of different ways, so it makes sense to scan and scan often.

2) Scan for spyware - It's really not a great thing when someone can watch what you're doing from your home or business computer. Whether they are watching directly or indirecting, using software, caution should be taken to make sure spyware is removed.

3) Avoid internet scams - If it sounds too good to be true or if you're getting something for nothing, avoid it at all costs. There are probably scams being created every day that focus on people's emotions in order to persuade them to take some type of unwise action. If you fall for a scam, it can costs hundreds or thousands of dollars and can be hard to dispute if you try to prove that the actions were fraudulent.

4) Avoid hoaxes - Hoaxes play on people's emotions especially to forward emails that contain myths or folklore. Since the emails may sound like something that has actually occurred, people forward them and the process continues.

5) Report and Recognize Phishing - Phishing involves someone trying to obtain your personal information such as bank account information through cleverly designed emails and webpages. The best thing to do is to report these types of incidents to the necessary authorities. The key component is actually recognizing the phishing attempts. If you receive an email that asks for personal information or has a link to login to an account, avoid it 99% of the time. Most organizations will not ask for social security numbers, account numbers, or passwords from email.

6) Avoid pornography - The best solution for avoiding most pornography that exists on the web is to install a filter. One of the filters that I recommend can be found Bsafeonline.com.This will take care of most of the process. Inappropriate sites will be blocked and parents can take an active approach at controlling the internet use in their home.

7) Use caution when blogging - Blogging can be a great thing most of the time. It is great for search engine optimization and building communities online, but caution should be used when including information that is personal or when discussing details of other people's lives. In addition, to keep people from stalking you, I would not suggest chronicling every detail of your every day life.

Devin Dabney is a computer consultant, author, speaker, and entrepreneur who is the founder and CEO of DabneyWorks Computer Consulting. DabneyWorks provides remote and in-person computer assistance , website design and auditing, and business consultation.