Phishing is one of the most prevalent of all Internet scams. At any one time, a large number of major financial institutions and online entities around the world will be the target of phishing scammers. Some high profile institutions such as Citibank and PayPal are targeted almost continually. Phishing scams attempt to trick people into providing sensitive personal information such as credit card or banking details.
Common Characteristics of Phishing Scam Emails
- Unsolicited requests for sensitive information
- The entire purpose of a typical phishing scam email is to get the recipient to provide personal information. If you receive any unsolicited email ostensibly from a bank or other institution that asks you to click a link and provide sensitive personal information, then you should view the message with the utmost suspicion. It is highly unlikely that a legitimate institution would request sensitive information in such a way.
- Content appears genuine
- Phishing scam emails are created to give the illusion that they have been sent by a legitimate institution. The email may arrive in HTML format and include logos, styling, contact and copyright information virtually identical to those used by the targeted institution. To further create the illusion of legitimacy, some of the secondary links in these bogus emails may lead to the institution's genuine website. However, one or more of the hyperlinks featured in the body of the email will point to the fraudulent website.
- Disguised hyperlinks and sender address
- Links in phishing scam emails are often disguised to make it appear that they lead to the genuine institution site. The sender address of the email may also be disguised in such a way that it appears to have originated from the targeted company.
- Email consists of a clickable image
- Some phishing scam emails may arrive as a clickable image file. That is, the entire email consists of an image that contains the fraudulent request for information. These are a particularly dangerous type because clicking anywhere within the email will cause the bogus website to open.
- Generic Greetings
- Because they are sent in bulk to many recipients, scam emails use generic greetings such as "Dear account holder" or "Dear [targeted institution] customer". If an institution needed to contact a customer about some aspect of his or her account, the contact email would most likely address the customer by name.
- Use various ruses to entice recipients to click
- Phishing scam emails use a variety of ruses to explain why it is necessary for recipients to provide the requested information. Often, the messages imply that urgent action on the part of the recipient is required. Some of the most common ruses are listed below. The scam emails may claim that:
- The customer's account details need to be updated due to a software or security upgrade.
- The customer's account may be terminated if account details are not provided within a specified time frame.
- Suspect or fraudulent activity involving the user's account has been detected and the user must therefore provide information urgently.
- Routine or random security procedures require that the user verify his or her account by providing the requested information.
What to do if you Receive a Suspected Phishing Scam
- DO NOT click on any links in the scam email.
- DO NOT supply any personal information of any kind as a result of the email
- DO NOT reply to the email or attempt to contact the senders in any way.
- DO NOT supply any information on the bogus website that may appear in your browser if you have clicked a link in the email.
- DO NOT open any attachments that arrive with the email
- REPORT the phishing scam (click here for reporting methods).
- DELETE the email from your computer as soon as possible.
If you need more information about a suspected phishing scam, visit the legitimate website of the targeted institution or contact the institution directly. The institution's website may provide current information about the scam email you received.
What to do if you Have Already Been Tricked into Submitted Information
If you have already submitted information to scammers as a result of a phishing scam, you need to contact the targeted institution for advice immediately. It is imperative that you act quickly to protect the account that has been compromised in the phishing attack.
For more comprehensive information about what to do, click the link below:
How to Avoid Becoming a Victim of a Phishing Scam
If you receive any unsolicited email from a bank or other institution that asks you to click an included hyperlink and provide sensitive personal information, then you should view the message with the utmost suspicion. If you have any doubts at all about the veracity of the email, contact the institution directly to check.
- Never click on a link in an email in order to access the website of a bank or other institutions that may be the target of scammers. The safest method is to manually enter the URL of the institution's website into your browser's address bar.
- If you supply sensitive information on a website, always ensure that the site is secure. The address of the page should start with "https://" not just "http://" and the Lock icon should be displayed in the browser's status bar. If these indicators are not present, it means that the site is not secure and information you enter on the site is not protected. Fraudulent web forms related to phishing scams are often non-secure sites. Please note, however, that even an apparently secure site may be fraudulent. The fact that a site appears to be secure is not by itself a guarantee that the site is legitimate. However, legitimate sites that require users to supply personal information will always be secure.
- Use firewall, antivirus and anti-spyware software to protect your computer system. Some phishing scam emails may carry trojans or other malware that may compromise your system.
- Ensure that your browser, system software and other applications have the latest security updates available. This will reduce the risk of scammers accessing your system via unpatched software vulnerabilities.
Daily Safety Check provides additional comprehensive Internet Filtering and Reporting solutions for families and businesses as a low-cost "Addon." Send a note to
[email protected] for more information.
