Printer-friendly
page
Screen-friendly
pagePhishing
For information about the August 25, 2008 Campus Email Phishing Scam, please visit this page.
Introduction
When identity thieves started looking for sensitive data such as passwords, social security numbers and bank account information, they employed tactics such as hacking your computer, stealing laptops, or looking for physical files such as old bank statements, to acquire the information they wanted. These techniques are still employed by identity thieves and they are still successful techniques.
However, identity thieves have discovered a new means of getting your sensitive information. They realized that by sending a cleverly designed email, many people will simply hand over their personal information -- you. The process of using email to trick you into giving away personal information is called phishing. Identity thieves are trying to lure you in to giving up your personal information, the same way a fisherman would lure a fish. Unfortunately, if you are not aware of this tactic, it can be highly effective.
This page is designed to help you spot phishing attempts and avoid falling victim to this technique.
What does a phishing email look like?
There is no one format that all phishing emails use. Some are phishing attempts are incredibly easy to spot while others are so sophisticated that it is understandable that people are fooled. We will divide phishing emails into three categories: clumsy, clever and calculated.
Clumsy
Clumsy phishing attempts are usually easy to spot. (More...)
Many times they are full of grammatical errors. They often pretend to be from individuals or companies that you have never heard from, selling things you don't want. While clumsy phishing attempts usually pose little threat, replying to them can indicate to the identity thief that your email address is a valid one, and that you may not be smart enough to recognize a phishing attempt.
Therefore, the best approach to take with clumsy phishing attempts is to simply delete them.
Clever
Clever phishing attempts usually catch the most sensitive data for identity thieves. (More...)
The reason is that the thieves take the time to craft carefully worded emails from sources you know and may already be doing business with. Common clever phishing emails appear to come from sources such as credit unions, banks, credit cards, eBay and PayPal. These emails will approach you asking you to verify account information (your account number, your password, etc).
There are several ways to spot a clever phishing email. The first way is to realize that the University of Illinois, nearly all banks, PayPal, eBay and credit card companies will NEVER ask you for your account information by email.
The second way is to look closely at the email address that sent you the message. Often times, clever phishing attempts will be sent from a name that looks reputable (i.e. "eBay Customer Service") but when you look at the actual address it is sent from, it is clear it is not from eBay at all. You should look at the server portion of the email address. The server portion is the section immediately following the @ sign. For example, in the address, test@uiuc.edu, "uiuc.edu" is the server.
A clever phishing email can be spotted because the server portion of the sender's email will not match up to the sender. For example, a clever phishing email from eBay will not be sent from an eBay server. Instead it could look like "ebay@userhost.com"
Sometimes, identity thieves will spoof the entire email address, making it look entirely legitimate. In those cases, you must look for other clues, such as links to web sites not related to the company, in order to spot the phishing attempt. If you are worried about your own email address being spoofed, you can find more information on email spoofing on this page.
Calculated
The most dangerous type of phishing attempt is a calculated phishing attempt. (More...)
In these cases, not only will an identity thief send an email pretending to be from a company or institution that you know, but they will try to include specific information about you. This is often referred to as spearphishing as it is targeting just one person. Usually that person is targeted because of the valuable information that they can access with their accounts.
These emails can be incredibly tricky to spot as an identity thief will include specific information already gathered about you such as the last four digits of your credit card number, your bank account number, or your address, for example. You can protect yourself from these messages by remembering that nearly all companies will never ask you for personal information through email. If you still have doubt about the validity of an email, do not hesitate to call the company that allegedly sent the email.
Also, checking the email address as noted above will many times tip off that the email that was sent was a phishing attempt. You should also type in web addresses instead of clinking on links, as phishing links will often take you to a phony site.
How can you protect yourself?
The easiest way to protect yourself from a phishing scam once you spot it, is to simply delete the email. Do NOT reply to the email.
You should also remember to never send anyone your personal information over email, even to a friend, a co-worker, or an employer. Email is most often insecurely transmitted and can later be forwarded on to other people. If you get in the habit of never sending sensitive information by email, you will be less likely to fall for phishing scams.
If you have a University of Illinois NetID and have not already done so, you should sign up for CITES Spam Control. CITES Spam Control does a great job of blocking many phishing messages before they reach your University email inbox. If you never read the phishing email, you can't be tricked by it.
Where can I find more information?
To see a list of documented email scams and to check and see if an email you received is a scam, visit http://www.snopes.com
To learn how the online community is battling the phishing epidemic, visit http://www.antiphishing.org/
To take a quiz to help you spot phishing scams, visit http://www.sonicwall.com/phishing/
To help combat the phishing problem by reporting a phishing scam to an online database of phishing scams, visit http://www.phishtank.com/