The Internet can be a scary place. And that is not just the Luddite in me talking. And no matter how hard we try to stop them, the bad guys seem to keep one step ahead of us. Take for example phishing. Phishing is a variety of tactics to fool people into giving up personal information that allows the bad guys to steal our money and/or our identity. If often starts with a fake e-mail from a bank or from eBay. At first, these attempts were rather clumsy. But because they worked enough of the time, the bad guys improved their techniques to fool even more unsuspecting folks. Remember, if this stuff does not work, they wouldn’t keep trying.
The accounting firm Kraft CPAs offers some assistance in sorting this all out. If you have received e-mails that really look like they are from your bank or eBay they offer advice on how to protect yourself and your small business:
Spoofed emails are a method used by scammers and hackers in an effort to obtain personal information from unsuspecting individuals and is commonly known as “phishing.” The scam artist crafts an email that appears to originate from a popular and legitimate company to entice the end user to reveal information such as passwords, credit card numbers, social security numbers or other types of personal data.
Even though the example email above appears to originate from member@eBay.com, it actually did not originate from eBay. The sending address can be modified, or spoofed, easily by the sender. Also, the link the scammer wants you to click is embedded in the “Respond Now” button and leads to a website that appears to be eBay, but is actually a site intended to gather your eBay logon information. Just as the sender’s email address, the links embedded in the email are easily spoofed, too.
So how do I recognize a spoofed email?
An email stating the company is updating customers’ account information is a common ploy. Always be suspicious of emails soliciting personal information. Reputable companies such as eBay will not request personal information from their customers by asking the user to click a link in an email. Your best bet is to ignore them altogether. If you believe the email may be legitimate, make a phone call to the vendor (using a number you know to be genuine) and ask for verification of the validity of the email.
How do I protect myself?
As mentioned previously, ignoring emails requesting personal information is best practice. Other measures you can take to protect yourself and your computer system are:
– Never email personal or financial information.
– Install anti-virus and anti-spyware software, keep them up-to-date, and perform regular scans.
– Install a personal firewall.
– If an email claiming to be from a financial institution is requesting personal information, report it to the financial institution.
– Always err on the side of caution. If a company needs any information from you for a legitimate purpose, they will find you.
– Utilize an email filtering system.
Kraft also recommends these sites as sources for useful information email protection.
www.us-cert.gov
www.antiphishing.org
www.nist.org
www.trendmicro.com/en/security/phishing
(The information from Kraft CPAs was used with permission).