Catching Phish...

Heard the term 'Phishing' but not quite sure what it means? Phishing refers to the evil attempt by crooks to steal your identity by using fear tactics to overcome your common sense. This image represents a 'phishing' expedition for the account information of eBay users...

Click on image to see it full size (opens new window)

How do you tell if it's a 'phish' or not (other than its rancid smell)?

First, no responsible retailer, on-line merchant, bank or other financial institution will ever ask you for account information over the internet. They just won't. Period. So rule #1: If an email asks for account information assume that it's bogus and delete it or report it.

Rule #2: If you're not sure, call, email or stop by the institution in question but don't use the contact information listed in the questionable email.

Tech tip: With certain email programs (later versions of Microsoft Outlook for example) you can hover over (place your mouse pointer over the link without clicking on it) a message's links to determine what the real link is.

For example, on the screen above I've hovered over the link begining "http://signin.ebay.com..." -- which looks legitimate -- to reveal the true link (in the rectangular box) which begins "http://ns.satrichai..." You can also 'right click' with your mouse in the message body and select "View Source" and review the html source code to see where your clicks will really lead you. Here's an example of what to look for:

You see...

Go to http://www.legitimate-web-site.com

...but by looking at the code you'd see something like the following line showing the real destination of the link to be the 'scams-r-us' site:

‹p›Go to ‹a href="http://www.scams-r-us.com"›http://www.legitimate-web-site.com/‹/a›‹/p›

Don't take the bait. Remember, "When in doubt: DELETE."

Check out the Anti-Phishing Working Group site for more information.

Thanks for reading,

tom.gray@gemsolv.com