Gone Phishing

Phishing scams are increasing at an alarming rate, and phishing scam artists are becoming increasingly sophisticated. What is phishing? Phishing is a type of online fraud where the perpetrators send bulk emails to thousands of people in the hopes of retrieving confidential information from a percentage of its recipients (just like in fishing with an "f", where a fisherman throws a baited hook and waits for a bite).

How do you recognize phishing? In a typical phishing scenario, a person receives an email appearing to have come from a bank, ISP, medical institution, etc. asking to re-supply some important details that, according to email, have been lost or compromised. The email will include a link to a bogus website where the entered information is misappropriated to steal the person's money, credit card details, or other valuable data.

A good general policy to follow is to never enter important personal information on a website solicited by an email. Legitimate institutions will never solicite information from customers using email. However, as phishing tactics become increasingly sophisticated, recognizing them requires more advanced detection methods. Here are a few advanced spoof recognition tips:

1. Links should relate to legitimate written addresses. If the link is simply an IP address (e.g. http://192.168.2.5) use a whois search to verify it. Whois
2. Links should not point to a completely different domain (e.g. http://www.clickonme.com instead of http://www.citibank.com)
3. Look for substitution of letters in the URL (e.g. http://www.micr0soft.com where the letter "o" is substituted with a "zero")
4. Look for a plausible-sounding but fake domain (e.g. http://www.verify.wachoviaonlineoperations.com)
5. Look for an address with a username that looks like a domain name (e.g. http://www.citibank.com@phishing.com)
6. Look for an address that uses a wildcard DNS record to disguise the domain name (e.g. http://www.citibank.com|mhtml:mid://000063/|cid:0659M54K@Re)
   

$137 million dollars and 14,000 souls were lost to phishing scams in 2004