RootsWorks
Something Here Smells Phishy
by Beau Sharbrough
Recently, I received an e-mail that at first glance appeared to come from eBay. It was telling me that it couldn't verify my account information. It told me to click on a link in the e-mail to log in to my account and update my information. If I didn't update my information, I would lose access.
I was suspicious. First of all, I know that if a company like eBay loses my information, I'll find out about it on the news, not in an e-mail. Second, I had a sense that the e-mail was just not legit. As I looked at it, I realized that it has that same lousy spelling, grammar, and punctuation that is typical of spam, junk mail, and the like. The salutation has a colon at the front of it, like a mutant mail-merge.
The first sentence didn't make sense. They couldn't verify my information because it was changed or incomplete? Get real.
The next sentence read: "update by signing in your account." Wouldn't we say "signing into your account?" The next sentence was also stilted. English just isn't that hard. Can't these yahoos construct a tricky sentence?
The call to action was a sentence that didn't start with a capital letter. ("go" instead of "Go.") And eBay would surely know how to spell management. (That word was really butchered.) The bottom of the message was filled with gibberish. What's that about?
The biggest tip-off, once I got suspicious, was the link to fix the problem. It wasn't at eBay.com--it was at tripod.com. What is tripod.com? It's a web hosting service from Lycos. What is accounts901.tripod.com? Nothing, there was no such page. Even the page that the link leads to is gone now.
If this letter was turned in for an English class, it would get a 75, max. As long as the con men are hiring C-students for writers, we'll be safer. I'm thinking that maybe crime doesn't pay.
I googled some of the text in the e-mail and got a number of hits. I chose one called Fraud Watch International (www.fraudwatchinternational.com). They define "phishing" as follows.
"The term 'Phishing' (pronounced 'fishing') is a slang IT word, made up by replacing the letter 'f' with 'ph.' Phishing, is exactly that, fishing for information--usually personal information such as credit card, bank account or social security numbers.
"Scammers 'Phish' for your personal information in a variety of ways, but most commonly through fraudulent emails claiming to be from your bank or another institution that already has your personal details, asking you to confirm these details. 
"Once scammers have 'phished' out your information, they could use it in a number of ways. Your credit card could be used for unauthorized purchases, or your bank account could be cleared out, or they may simply gather the information for an identity theft scam, or sell your information to identity theft rings.
"Phishing emails are commonly used in association with a fake web site that looks very similar to a real website from the relevant institution."
It turns out that phishing is an international sport. Along with the eBay thing, I've seen them for Paypal and Washington Mutual. Other scams include the Nigerian letter, bogus credit card offers, and more examples of human frailty than an episode of Desperate Housewives.
How can you spot a phishing e-mail? It has some combination of the following:
- A deceptive subject line.
- A forged sender's address. (It's not from eBay, it's from someone else.)
- Important looking content. ("Your account will be restricted.")
- A disguised hyperlink (or they don't even disguise it--there are lots of people who don't read them).
The link in the e-mail will take you to a Web page designed to trick you by using:
- Real looking content (an eBay logo, for example).
- Similar URLs to that of the institution they pretend to represent.
- Occasionally, there is no effort to hide the URL.
- Occasionally, they come with a form of "URL spoofing" where they cover up the real URL and show a fake one.
- A form for the collection of data.
- Pop-up windows (with no URL or identifying info).
- Spyware. (It puts it on there and then gathers data later.)
How Can You Protect Yourself?
You can protect yourself by adopting a few new habits. Don't click on hyperlinks in e-mail unless you are sure about the source. Use anti-spam, anti-virus, and anti-spyware routines regularly. Educate yourself about Internet fraud. Tell your family and friends about these things, so they will be careful too.
These people are very smart, and they know computers better than we do. They're going to a lot of trouble for the $3.97 they'll get from my credit card.
More Information
If you want to discuss phishing issues, please drop by the RootsWorks Forums
at www.rootsworks.com/forums. Registration is free, and I'd be interested to know what you think.
Beau Sharbrough is a product manager at MyFamily.com. His articles contain his own views and opinions and do not reflect any corporate policy or statement by the company. He lives in Provo, Utah, where he likes looking at mountains. The RootsWorks series of articles focuses on genealogical applications for generic technologies. Please note that he cannot assist you with your individual computer and genealogy problems. Visit the RootsWorks website (www.rootsworks.com) for links to previous articles and Beau's lecture schedule. (Next stop: NERGC in Maine, 31 March 2005, www.nergc.org/).
Copyright 2005, MyFamily.com. All rights reserved.
Access a printer-friendly version of this article, e-mail it to a friend, or submit your feedback. |
Ancestry Daily News
