Online Scams

"The man or woman who is not strong against anything is usually not strong for anything."

Phishing Sites Are On The Rise.... Seems Like There Is No End In Sight!

In just a years time, from November 2005 to November 2006, the number of new phishing sites in a month rose from approximately 4500 per month in November 2005, to over 37,000 new sites per month this past November 2006. Even with all the available news and articles warning about the dangers of the Phishing phenomena, the number of Americans taken in by phishing schemes has almost doubled.

I have put together some important articles from various authorities and authors on this topic. I would personally recommend that you red these articles and try to avoid being a statistic as being one of many who have lost a total estimated $2.8 billion in just this past 2006, by falling into the phishing trap.

�Phishing� on the �Pharm�: How Thieves Combine Two Techniques to Steal Your Identity
by: John Young

Bob squinted at the email and began to read:

"Dear eBay User, as part of our security measures, eBay Inc. has developed a security program against fraudulent attempts and account thefts. Therefore, our system requires further account verification�"

Security Measures. A threat to suspend his account to prevent "fraudulent activity". The email went on to say that there were "procedural safeguards with federal regulations to protect the information you provide for us."

Bob clicked the link and was confronted with an authentic looking logon page, just waiting for him to input his user name and password and confirm what ebay supposedly didn't know.

He almost did it. The page looked absolutely authentic, and he had already been "set up" by the email message. His fingers were poised over the keyboard when he happened to glance at the URL.

There was something very, very wrong with it.

"PHARMING" TO FLEECE SHEEP

The art of "pharming" involves setting up an illegitimate website that is identical with its legitimate prototype, for example the ebay page Bob was almost suckered into using, and redirecting traffic to it.

"Pharmers" can do it in two ways:

1. By altering the "Hosts" file on your computer. The Hosts file stores the IP address of websites you have been accessing. By inserting a new IP address into the database field corresponding to a website, your own computer can be redirected to the pharmer's website. Any information you give the bogus site is immediately hijacked by the pharmer.

2. Hijacking the DNS (Dynamic Name Server) itself. A DNS matches the names of address with their IP addresses. If this server can be coerced into assigning new IP addresses to traditional names, all computers using the name resolution provided by the DNS server will be redirected to the hijacker's web site.

Once that happens, it's time to be fleeced.

DOWN ON THE PHARM

"Pharmers" hijack your "hosts" file or DNS servers using Spyware, Adware, Viruses or Trojans. One of the most dangerous things you can do is to run your computer without some form of Internet Security installed on it.

Your security software should be continually updating its virus definitions, and be capable of warning you if something has been downloaded from a web site or through email. It should be able to remove it, "quarantine it", or tell you where it is so that you can remove it by hand.

You should also have Spyware and Adware programs installed, and be aware of any change in Internet browsing patterns. If your home page suddenly changes, or you experience advertising pop ups (which may pop up even when you are not hooked up to the Internet), you should run a Virus, Spyware or Adware scan.

Thanks to the efficacy of these protection programs, pharming is a lot more difficult than it used to be. It isn't as easy to hijack a computer as it once was.

So, the "pharmers" have teamed up with the "phishermen" to get you to visit the bogus web page yourself, and enter all the information they need.

PHISHING TO CATCH YOU ON THE PHARM

As Bob discovered, the page he had been taken to by the bogus email message was identical to the ebay logon page. Identical in every way except for the URL.

Out of curiosity, he checked the URL for the ebay logon by accessing ebay directly and clicking on the logon link. The two URL's were nothing alike, except the bogus one did have the word "ebay" in it twice � just enough to make it look authentic.

By combining the two techniques, the phishermen/pharmers had avoided the high tech problems associated with downloading a Virus that could get past his protection software. They had gone straight for the throat.

Bob's throat.

YOUR ONLY REAL IDENTITY THEFT PREVENTION AND PROTECTION

The bottom line is that the only real protection against the pharmers and phishermen is YOU. There are three things you must consider when you read any email demanding information:

� Why do they want it? Be extremely skeptical when they say they have to "update their records", "comply with federal regulations", or prevent fraud. They are the ones initiating the fraud.

� Why can't this be done at the website? Why not invite you to access the website directly and provide this information? The answer is because the bonafide company doesn't need an update.

� What does the URL look like? Is it a series of subdomains some of which have the name of the bonafide company? Most likely the subdomain is set up with a free hosting company.

� Have they provided partial information about you as a guarantee that the email authentically comes from the legitimate source? Be very careful of this one. This technique is effective for "pretexting", impersonating a person or company, and was used in the Hewlett Packard scandal to collect information. Just because they know your first and last name (and any other information � known only to the legitimate source) doesn't mean the email is legitimate. They probably hijacked the information off the server.

THE BOTTOM LINE

The bottom line is: don't provide any information at the behest of an email, no matter how authentic it looks, or how authentic the page it directs you to looks. If you must log in, do so at the parent site itself.

Your Identity Theft prevention and protection is, in the final analysis, up to you.

Don't be the next sheep fleeced by the pharmers who caught you with the phisherman's hook. Being dropped naked into their frying pan is NOT a fate you want.

Copyright 2006 John Young

About The Author

John Young is a writer with a scientific and technical background living in California. At the age of 62, he is the father of four, grandfather of 13, and lives with his wife and cat �Bear�. Please check out his latest book on Identity Theft at http://www.youridentitystolen.com.

For some suggestions on Fire Walls, Virus, Spyware and Adware protection software visit his �California Software Shop� at http://www.pcreveal.com

Protect Your Online Accounts From Phishing Scams
By: David Slone

What is phishing? Phishing involves the sending of an e-mail falsely claiming to be from an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft. The e-mail directs the user to visit a Web site where they are asked to update personal information, such as passwords and credit card, social security number, and bank account numbers. It is relatively simple to make a Web site look like the legitimate site by mimicking the HTML code or by framing parts of the pages.

Many people fall victim to email scams designed to steal log-in information for accounts such as PayPal, eBay, online banking accounts and more. Scammers send emails to every address they can obtain so you may receive these even if you dont have an account with the targeted enterprise, site or company.

The scam emails keep getting better and better in their appearance. You may receive an email that pretends to be sent from eBay. The email will have all the appropriate logos and will often be formatted in the same way. The links within the email can even appear to be directed to legitimate pages within eBay.

For example, e-mails supposedly from eBay claim that the user's account is about to be suspended unless they clicked on the provided link and updated the credit card information.

Recently I received an email claiming to be from PayPal. It appears to be a receipt for an eBay purchase that I know nothing about. The subject line is "Receipt for Your Payment"

The body of the email included a description of the ebay item that had allegedly been purchased using my PayPal account. Below that was a notice that said:

Note:
If you haven't authorized this charge, click the link below to dispute transaction and get full refund

I wonder how many people receiving a similar email would quickly click on the link provided in order to contest the charges.

OK, I know to be cautious with this sort of thing so I did not click on anything in the email. Instead I went to PayPal on my own and logged in. Guess what? There is no record there of the purchase!

Then I started looking at the formatting of the email. When I viewed the properties of the message I found that it was actually from a takethatfanclub.com sender and NOT paypal. Just because it says that it is from such and such.com at the top of the email doesn't always mean that is who it is from. The "From" name in an email can easily be altered.

This email was formatted more like a received payment PayPal email than it was an actual receipt. I looked at all of my other emails titled "Receipt for your payment" and not one of the others was formatted like this one.

Other types of scams that involve PayPal usually involve a message about unauthorized access attempts. The sender will tell you that someone has tried to get into your account. As a result your account is in danger of being "frozen". However if you click the link in the email (You are told) you will be able to enter your password to avoid the loss of your account. Naturally, those unfortunate enough to give their log in information will have given it to strangers.

Remember that this is not limited to PayPal. Users of Storm Pay, e gold, eBay and more will see similar emails.

Watch out for scams like this that are designed to trick you into submitting information (like passwords) to allow the sender to access your account. Whenever you receive any suspicious messages go to your account via a new browser and by typing in the url. Never click a link in an email that is supposed to take you to your PayPal account. If you make that the rule then your account information (and funds!) will be much safer.

If you believe that you have provided sensitive financial information about yourself or any accounts through a phishing scam, you should:

- Contact your financial institution or account immediately

- Contact the three major credit bureaus and request that a fraud alert be placed on your credit report.

Bureaus and phone numbers are:
Equifax - 1-800-525-6285
Experian - 1-888-397-3742
TransUnion - 1-800-680-7289

- File a complaint with the Federal Trade Commission at www.ftc.gov or call 1-877-382-4357

- You can also contact the Internet Crime Complaint Center at www.ifccfbi.gov if you think you have been a victim of a phishing scam.

About the Author:

David Slone is the Webmaster of http://www.honestinformation.com Visit HonestInformation for Webmaster resources, content, helpful tutorials and more. Many articles on various subjects available to use as content for your website or newsletter.

Article Source: www.iSnare.com