University IT » Security » Protect Yourself
Phishing
- What's phishing?
- How do people fall for that?
- Avoid getting hooked by phishers
- What should I do if I think something phishy's going on?
- Example of a phishing email
- More information
- Related topics
What's phishing?
Phishing is an Internet scam where scam artists send official-looking emails to people, attempting to fool them into disclosing their personal information. They can pretend to be from a legitimate bank, organization, government agency or store, or claim to be the host of a lottery or contest. They try to get victims to reveal personal information such as user names and passwords, banking records or account numbers, or social security numbers by replying to the email or entering it on a phony website. Phishing is dangerous because it can easily result in credit card fraud or identity theft.
How do people fall for that?
Phishers are tricky. They use upsetting or exciting (but false) statements in order to elicit an immediate response from users. This is how they reel people in. Phishing occurs more often than you might think. According to Mail Frontier, 6.1 billion phishing emails are sent world-wide every month!
Avoid getting hooked by phishers
Now that you know phishers' motives and methods, follow these basic security precautions in order to avoid becoming a victim.
- Be on the lookout for suspicious emails. Legitimate, responsible companies will never solicit personal information over email. Never reveal personal or financial information in a response to an email request, no matter who appears to have sent it.
- Don't click on links or attachments contained in emails. Instead, visit the mentioned website directly by using a search engine to locate the real site. If the web address found through the search engine and the address in the email do not match up, the email is most likely a phishing attempt or spam and should be deleted.
- Set up a spam filter. A spam filter can greatly reduce the amount of phishing emails you receive. The University offers a free spam management system, Sophos PureMessage.
What should I do if I think something phishy's going on?
- Act immediately if you think you've been hooked by a phisher. If you've given personal information to a phisher, notify the companies who manage your compromised accounts right away. For information on how to put a " fraud alert" on your files at credit bureaus, contact the Federal Trade Commission's ID Theft Clearinghouse atwww.consumer.gov/idtheft or 1-877-438-4338.
- Report phishing, whether you have become a victim or not. Tell the legitimate company that a phisher was impersonating. Also report the problem to the National Fraud Information Center and Internet Fraud Watch at www.fraud.org or 1-800-876-7060. Your report can prevent other people from becoming victims.
Example of a phishing email
| Subject | eBay Account Verification |
| Date: | Fri, 20 Jun 2003 07:38:39 -0700 |
| From: | "eBay" <accounts@ebay.com> |
| Reply-To: | accounts@ebay.com |
| To: |
Dear eBay member,
As part of our continuing commitment to protect your
account and to reduce the instance of fraud on our
website, we are undertaking a period review of our
member accounts.
You are requested to visit our site by following the link given below
http://xxxxxxx.xxx.xxxx.xxx/
Please fill in the required information.
This is required for us to continue to offer you a
safe and risk free environment to send and receive
money online, and maintain the eBay Experience.
Thank you
Accounts Management
As outlined in our User Agreement, eBay will periodically
send you information about site changes and enhancements.
Visit our Privacy Policy and
User Agreement
if you have any questions.
Copyright © 1995-2003 eBay Inc. All Rights Reserved.
Designated trademarks and brands are the property of their respective owners.
Use of this Web site constitutes acceptance of the eBay
User Agreement
and Privacy Policy.