Watch Out for Fake Email Messages

A sample email message I recently received: “Your Authorize online service has expired. If your intention is to remain a Authorize customer please begin the activation sequence as soon as possible. Failure to update your information will lead to the permanently suspension of your account. Click here to Log-in to your account and update your information.”

by Simone Bouyer

This is an example of Phishing, the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity. Trust your instincts. If an e-mail message looks suspicious, it probably is.

This was an easy one to ignore since I don’t have an authorize.net account. However, I have received similar messages from Facebook, PayPal, and American Express. Although these messages appear to come from legitimate businesses, they are fakes. Most contain misspelled words, so look for those first.

A second BIG clue is that no legitimate business is ever going to
send you an email message asking you to update your contact information
by clicking a link. They will send you all types of other messages,
welcome to your new account, links to FAQ, etc., but most will never
request account information via an email message.

If you do click the link, pay attention to the web address that
shows in the status window. The above link led to
authorize.pttwebservices.com, which is not the same as authorize.net.
This is a hacker at work. The links that you are urged to click may
contain all or part of a real company’s name, but the link is actually
taking you to a phony web site.

About Domain Names
Anyone can purchase a domain name and web hosting for that name.
Hackers can create a subdirectory on their website using a legitimate
name. They may create sears.myaccounts.com, or paypal.commercial.com.
The dot in the middle of the name indicates that you are accessing a
subdirectory on the server. The actual domain name ends in .com, or
.net. or .org. A legitimate business may use subdirectories, but their
main domain name will be paypal.com, or sears.com.

Thus,
messages from accounts.sears.com are legitimate, while messages from
sears.accountcentral.com could be fake. Also look for misspellings in
domain names — micosoft.com is not the same as microsoft.com.

A friend’s Yahoo account was recently hacked in just this way.
She responded to an email requesting that she click a link to update
her account information. When she did this she was presented with a
page that looked exactly like Yahoo’s log-in page. Once she logged in
on the fake site the hacker had everything he needed. The hacker
changed her password, locking her out of her account. The hacker then
sent a message to all of the contacts in her address book. The message
stated that Tina, my friend, was traveling abroad when her purse was
stolen, and that she desperately needed me to send her money so she
could return home. Many of us who received this message thought it was
a bit suspicious and replied with questions that only Tina would know
the answer to. Others thought the message was a serious request for
help.

Social networking sites have recently become a target for
phishing. Once in, a hacker has access to all types of personal
information about you. Facebook users and Myspace users are prime
targets. Always be suspicious of any official looking messages. The
best thing to do is to never click a link in an email message. Instead
access your online accounts the way you normally do, via a bookmark on
your browser. That way you can see for yourself if your account
information needs updating.

Some messages urge you to act immediately by saying that an
account will be closed in 48 hours if you don’t take action. Don’t do
it. Call your bank or financial institution. They wouldn’t send you an
email message if it was that urgent.

Other Online Scams
You did not win the lottery held in Great Britain. You are not the
new trustee for 1 million dollars from a Uganda prince in exile. There
is not a group of 20 German tourists who need to make reservations at
your bed and breakfast. Likewise, no one in Brazil wants to purchase
hundreds of the things you have for sale on your website. All they want
is your bank account information, and once they have that you are done
for.

If you think you’re the victim of phishing, report the incident.
Contact your credit card company if you have given out your credit card
information. Reporting that your account may be compromised and closing
the account should be your first step. Send the entire fraudulent
message to the company that’s been misrepresented. Remember to contact
the organization directly, not through the e-mail message you received.

You can also report the phishing scam to the Anti-Phishing
Working Group at [email protected] and to the FTC at
[email protected].

Please be suspicious of all email messages, even if it looks like it came from someone you know.