Don't be a phishing victim

Imagine that tomorrow morning, you get up out of bed and check your e-mail. There is a message from your bank indicating that you are overdrawn on your cheque account because a cheque that you wrote for R2 457.83 bounced. You don't remember writing a cheque for this amount. What do you do?

Hopefully, you would call the bank rather than logging onto the bank's Web site through the link on the e-mail to check the problem out for yourself.

Unfortunately, many people still cannot identify these types of e-mails as the phishing scams they are. The Johannesburg Magistrates Court heard last week that banking clients in South Africa were collectively robbed of R180 million in 2010 through phishing scams.

“These e-mails look exactly like e-mails sent by the genuine organisations themselves,” explains Simon Campbell-Young, CEO of specialist distributor Phoenix Software.

“These messages all look very convincing and authentic. However, they are fraudulent e-mails constructed by con artists to look like legitimate communication. They usually ask victims to take urgent action to avoid a consequence or receive a reward. The desired response typically involves logging into a Web site or calling a phone number to provide personal information. Sometimes victims need only click on links or open e-mail attachments for their computers to become infected by malicious software that allows phishers to retrieve the data they want or take control of the victim's computer to launch future attacks.”

Although the details of phishing scams can vary, the result is usually the same: thousands of unsuspecting victims give information to criminals who then use it to break in to their accounts and steal their money or identities, or both. "Phishing is a two-time scam," Campbell-Young says. "Phishers first steal a company's identity, and then use it to victimise consumers by stealing their credit identities."

So how do you spot the scam and avoid being victimised by it? According to Campbell-Young, a good security software suite will do most of the work for you. “Kaspersky intercepted more than 209 million network attacks during December and neutralised over 196 malicious programs. With a good security solution, many of these e-mails will never even reach you.”

He adds that if you ever receive an e-mail message from your bank, your ISP, PayPal, EBay, Amazon, etc, read the note over several times. “Odds are that the note will appear legitimate, but you need to look for something fishy (no pun intended). For example, does the note have misspellings or bad grammar? Is this the first message that you have ever gotten from the company? Does the company even have your e-mail address on file? If you have any suspicions at all about the message, then the message is probably illegitimate.”

The best thing to do in that case is to call the company that allegedly sent you the message. Never use the phone number included in the message though. Instead, take the time to look the phone number up in the phone book. It's better to spend a few extra minutes looking up a number that you already have in front of you than to be a victim of a scam.

Obviously, you should never click on a link within a suspicious message. If you really must visit the Web site that the message claims to be from, enter the site's address into your browser manually. Other precautionary steps that you can take are to review your bank statements and credit card statements regularly to make sure that no one is stealing from you or making purchases in your name.

“If the e-mail refers you to a Web site, look carefully at the URL. It's easy to disguise a link to a site. Beware of the @ symbol in an URL,” Says Campbell-Young. “Most browsers will ignore all characters preceding the @ symbol, so this Web address http://www.respectedcompany.com@thisisascam.com - may look to the unsuspecting user like a page of Respected Company's site. But it actually takes visitors to thisisascam.com. The longer the URL, the easier it is to conceal the true destination address.”