An Introduction to Phishing- How to Recognize One

Report Suspicious E-mails If you think you've received a phishing e-mail message, do not respond to it or click on any links. Report it now.

Phishing (pronounced 'fishing') has emerged as one of the most wide spread types of Internet piracy today. Phishing is a type of deception designed to steal your valuable personal data, such as credit card numbers, passwords, account data, or other information. Scammers 'phish' for your personal information in a variety of ways. Con artists might send millions of fraudulent e-mail messages that appear to come from Web sites you trust, like your bank or credit card company, and request that you provide personal information.

What does a phishing scam look like?
As scam artists become more sophisticated, so do their phishing e-mail messages. They often include official-looking logos from real organizations, the web address, and other identifying information taken directly from legitimate Web sites.

It is important to follow basic security best practices to keep yourself safe. e-mail links are a convenient method of sending information to someone. With just a click, the mail recipient can go to a website or open an attachment.

People click on e-mail links all the time without ever asking the question "is this safe". Here are a few questions we should ask ourselves before clicking on a link:

1. How much do I reveal about myself by clicking on this?
2. Am I sure this is a web link?
3. What alternative is there?

The amount of information divulged when you click depends on your browser, e-mail software and security settings.

How can you tell if an e-mail message is fraudulant?

Here are a few phrases to look for if you think an e-mail message is a phishing scam.

1. "Verify your account" - USA Federal or any other businesses should not ask you to send passwords, login names, Social Security numbers, or other personal information through e-mail.
2. "If you don't respond within 48 hours, your account will be closed." - These messages convey a sense of urgency so that you'll respond immediately without thinking. Phishing e-mail might even claim that your response is required because your account might have been compromised.
3. "Dear Valued Customer." - Phishing e-mail messages are usually sent out in bulk and often do not contain your first or last name.
4. "Click the link below to gain access to your account." HTML-formatted messages can contain links or forms that you can fill out just as you'd fill out a form on a Web site. The links that you are urged to click may contain all or part of a real company's name and are usually "masked," meaning that the link you see does not take you to that address but somewhere different, usually a phony Web site. (see example below)

What you see is not always what you get.
The link name and the link address do not have to agree. It is easy to change the address on a link. If you’re in Word, simply right-click on the link, edit hyperlink and change the address.

Here is an example of https://www.usafedcu.org directing to different URL's:

In the first example if you compare the address to the link, you could easily miss the imbedded "L". If you were to click on it, the phisher could easily have created a bogus site that duplicated the actual legitimate one. If you were to enter any personal information, the phisher would have very powerful information.

The second example shows a completely different URL. In this case it is pointing to Google.

Spammers and phishers can modify the address further so you cannot determine you’re at the wrong site until it’s too late.

So, how do you avoid being caught by an imbedded e-mail link?
When someone sends you a link, either retype it in your browser address bar or cut/paste it from the e-mail to the browser. This will ensure What You See IS What You Get.

Beware of clicking on ads or pictures from unknown senders. The damage can be done just by clicking, so it’s better not to be curious.

When you send e-mails, remove hyperlinks. In Word, you can do this by right clicking on the address and selecting “Remove Hyperlink.”

By hijacking brand names of banks, e-retailers and credit card companies, phishers attempt to convince recipients to respond. Technical schemes include installing malware onto personal computers, unbeknownst to the user, to steal credentials, using Trojans and spyware that records keystroke information.

Criminals then use the data they obtain to steal your identity and run up bills or commit crimes in your name. For instance, your credit card number could be used for unauthorized purchases, your bank account could be cleared out and your personal information could be sold to an identity theft ring.

How to handle suspicious e-mails.

1. If you think you've received a phishing e-mail message, do not respond to it.
2. Report suspicious e-mail to USA Federal more >
3. Don't click links in e-mail messages.
4. Type addresses directly into your browser
5. Check the security certificate before you enter personal or financial information into a Web site. (see padlock example below)
6. Don't enter personal or financial information into pop-up windows.
7. Use the latest products and services to help warn and protect you from online scams
8. Keep your computer updated
   
   

Additional Safety Information

USA Federal promotes safe computing practices through the Security TEAM, an educational program designed to empower members with the tools to identify and avoid security threats. For additional information on phishing, read How Not to Get Hooked by a ‘Phishing’ Scam published by the Federal Trade Commission (FTC).

Glossary of Terms:

Malware - Short for malicious software; Any program or file that is harmful to a computer user. Malware includes computer viruses, worms, Trojans, and also spyware, programming that gathers information about a computer user without permission.

Spyware - A computer program that gathers personal data on your computer and information about your activity on the Internet and reports that data to someone else without your knowledge. Spyware is widely used as a "marketing" tool to gather information about your interests and then target you for advertisements (typically Spam e-mail) that should appeal to those interests. Spyware can also be a nuisance by slowing your computer down or even making it difficult for you to view certain web pages you would like to visit. Primarily, though, spyware is collecting information about you and your computer usage without your knowledge and supplying that information to others.

Trojan - A computer program that infects your computer when opened, usually masquerading as a legitimate program, such as a game or utility. When executed, a Trojan usually performs the expected function, but also infects your computer. Trojans often gather information about you and/or your computer (files, passwords, etc.) without your knowledge, and send this information back to the person who created the Trojan. In extreme cases, they can also give the sender complete access to your computer without your knowledge. Also referred to as Trojan Horse. Term comes from Greek mythology about the Trojan War, as told in the Aeneid and the Odyssey.

Virus - A computer program that, when opened, attempts to alter files and duplicate itself by being copied or initiating its copying to another program or document. Viruses can be transmitted as attachments to an e-mail or as a downloaded file, or be present on a disk or CD. Some viruses wreak their effect as soon as their code is executed; other viruses lie dormant until circumstances cause their code to be executed by the computer.

Worm - A self-replicating virus that does not alter files but resides in active memory and duplicates itself. Worms use parts of an operating system (i.e. Windows) that are automatic and usually invisible to the user. It is common for worms to be noticed only when their uncontrolled replication consumes system resources, slowing or halting other tasks. A virus is able to spread on its own without human interaction, usually by resending itself as an e-mail attachment or as part of a network message.