Home > Make a Difference in 15 Minutes > Phishing: Reduce Identity Theft

"PHISHING": REDUCE IDENTITY THEFT

by Michael Organ
Phishing Identity Theft

"Phishing" is a new and powerful weapon used by identity thieves. Over the past twelve months, over 9 million Americans have been victims of identity theft.

Technology-savvy identity thieves use phishing emails to steal a victim's account information, and then their money. Every day, people like you (or your parents) are being duped.

The annual cost of identity theft has passed the $52 billion mark, according to The Privacy Rights Clearinghouse. And while many consumers are now careful to avoid identity theft by shredding paper account statements before throwing them in the garbage, phishing emails could represent a far greater threat.

Here's how phishing works:

A potential victim receives an email from what looks like a well-respected company. (Phishers often spoof the identity of larger companies, such as Visa, eBay, and PayPal, not because the thieves know that you have an account with them, but because it's good gamble that you might.)

The phishing email will generally alert you to some "questionable activity" surrounding your account, and then "as a precaution", you are prompted to click on a link that is supposed to take you to the spoofed company's official website where you can update your security information. This is usually followed by a claim that if you do not comply, your account will be deactivated or canceled. However, this link in the phishing email will usually route you to a Trojan horse website with similar logos and seemingly official information, to make you believe it is real. Once at the Trojan horse website, you are prompted to enter your user name and password. At that point, you have generally compromised yourself, your information, and if you're unfortunate enough, your finances.

Companies like eBay and PayPal are working hard to combat this phishing threat. PayPal's statement regarding phishing offers a good rule of thumb if you're ever concerned about the legitimacy of an email:

"PayPal emails will address you by first name, last name, or business name, and NOT by "Dear PayPal User" or "Dear PayPal Member". If you are ever uncertain about the validity of the email or the email links, open a new web browser window and type in http://paypal.com. If you think you have received a fraudulent email, forward the entire email to spoof@paypal.com and then delete it from your email account."

  • Educate other computer users to recognize email attempts to steal their identity.
  • Report phishing emails.

After receiving your identity theft alert, reputable companies will try to shut down the phishing site almost immediately. To assist with that effort, forward the entire phishing email to the spoofed company's security team.

Here's how to reach some of those security teams:

To learn more: The Anti-Phishing Working Group provides further information on how you can prevent phishing and identity theft.