LPT730 Lab #3 - Part 1, Phishing

The term "phishing" describes the act of trying to fraudulently acquire private and sensitive information from someone for criminal purposes by pretending to be a legitimate entity. A common example of phishing is an email that looks as if it came from your bank, informing you that your bank card has been accessed in some far away country and that you could be out some money. It's a common tactic for the message to try to prompt a strong emotional reaction (e.g., panic, fear or greed) from a potential victim. The message then points you to a link that when clicked, displays a web page asking you for your card number and PIN in order to verify your card's activity. But both the email message and the web page are fraudulent. They're designed to look exactly as if they've come from the actual bank. If you enter the information it won't be long before your account will be empty.

Early phishing attempts of this type could be detected by moving the mouse cursor over the link in the email message and looking at the control bar. If the web address displayed wasn't the bank's, you knew your were being lied to. But because today's email messages can have embedded javascript (programming code) that alters a browser's status bar, it can be almost impossible to detect a phishing attempt. Phishing doesn't have to occur on your computer. You could just as easily get a voice message from someone claiming to be your bank leaving a number to call back and because they use a voice-over-IP (VOIP) phone number and false caller ID information they could appear to be legitimate.

Some Tips to Help You Avoid Phishing Attacks

• Don't click on links in an email to go to a website. Use your bookmarks or type a trusted address into your browser's location bar.
• Don't call the phone numbers that come in emails. Use a number from your paper statement or from the company web site.
• Update your web browser. Microsoft Internet Explorer 7 and Mozilla Firefox 2 or later contain anti-phishing features. These are the oldest versions you should be using.
  

For a more complete list of tips try here.

References
---
Anti-phishing working group - http://www.antiphishing.org/
The Phishing Guide - http://www.technicalinfo.net/papers/Phishing.html
Wikipedia - http://en.wikipedia.org/wiki/Phishing
RCMP - http://www.rcmp-grc.gc.ca/scams/phishing_e.htm
Repoting Economic Crime On-Line - http://www.recol.ca/