What are some of the ways of identifying phishing emails?

May 2012
M	T	W	T	F	S	S
« Feb
	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30	31

July 15th, 2006

What are some of the ways of identifying phishing emails?

[ASK! Editor: In view of the recent scams targetted at Citibank and OCBC customers, here are some methods to identify "phishy" emails]

Some of the recommended tips to note when determining the authenticity of emails and avoiding phishing scams are:

1) Be suspicious of any email with urgent requests for personal financial information.

unless the email is digitally signed, you can’t be sure it wasn’t forged or ‘spoofed’;

phishers typically include upsetting or exciting (but false) statements in their emails to get people to react immediately;

they typically ask for information such as usernames, passwords, credit card numbers, social security numbers, etc.;

phisher emails are typically NOT personalized, while valid messages from your bank or e-commerce company generally are;

you should only communicate information such as credit card numbers or account information via a secure website or the telephone.

2) Don’t use the links in an email to get to any web page, if you suspect the message might not be authentic.

e.g the link http://www.google.com@members.thinkbank.com/ may deceive a casual observer into believing that the link will open a page on www.google.com, whereas the link actually directs the browser to a page on members.thinkbank.com;

instead, call the company on the telephone, or log onto the website directly by typing in the Web adress in your browser.

3) Always ensure that you’re using a secure website when submitting credit card or other sensitive information via your Web browser.

ensure you’re on a secure Web server, check the beginning of the Web address in your browsers address bar -it should be “https://” rather than just “http://”.

4) E-mails with misspelled words or wrong punctuation.

for example, “Paypal” vs. “PayPal,” or “citibank” vs. “Citibank.”. It is always good to be cautious to note and compare details of the company’s logo;

also, misspelled URLs or the use of subdomains are other common tricks used by phishers ,e.g URL: http://www.namebank.com.example.com

5) If an e-mail addresses a user in a generic fashion, it is likely to be an attempt at phishing.

e.g. “Dear valued eBay member”, or “Dear Paypal Member”

6) Cross site scripting

In this attack method users may receive a message saying that they have to “verify” their account, by following a link to what appears to be an authentic website; in reality, the link is forged, although it is very difficult to spot that the link is manipulated to perpetrate this attack.

If you suspect that you have received a phishing email, do check with the organisation involved and/or check the organisation’s official website for any information.

Sources: Anti-Phishing Working Group, US Federal Trade Commission

All websites last accessed 15th July, 2006.

Read on for suggested books on phishing and other scams!

The Symantec guide to home internet security by Andrew Conry-Murray and Vincent Weafer
Upper Saddle River, N.J. : Addison-Wesley, c2006
Call No.: 005.8 CON -[COM]
Click here for item availability.
Description: The Internet is crawling with risks; if you bank or shop online, or even just surf the Web and send e-mail, you are exposed to hackers, thieves, and con artists. Today’s bad guys don’t need to pick your locks or break your windows: they can attack you and your family over the Internet. Are you prepared? Enjoy a safer online experience with easy, step-by-step help from Symantec, the world’s most trusted security provider. This easy-to-understand book helps protect you against Internet threats. Written specifically for nontechnical computer users, you’ll learn simple ways to keep you and your family safe and secure while online.

Geeks On Call PC security and privacy : 5-minute fixes by J. R. King
Indianapolis, IN : Wiley Pub., 2006
Call No.: 005.8 KIN -[COM]
Click here for item availability.
Description: Learn how to configure Internet Explorer and Firefox for safer web browsing and create separate user accounts for your family members that limits user access levels, and how to protect your laptop and use public computers safely. Other security tips in the book includes those for e-mail, Internet, data and digital threats. Also contains practical information about safe instant messaging, chatting, e-shopping and phishing etc.

Phishing exposed by Lance James
Rockland, Mass. : Syngress Pub., 2005
Call No.: 364.168 JAM
Click here for item availability.
Description: World-renowned phishing expert Lance James exposes the technical and financial techniques used by international clandestine phishing gangs to steal billions of dollars every year. The book is filled with technically detailed forensic examinations of real phishing scams. Armed with this invaluable intelligence, law enforcement officers, system administrators, and fraud investigators can resolve existing cases and prevent future attacks.

Phishing : cutting the identity theft line by Rachael Lininger and Russell Dean Vines
Indianapolis, Ind. : Wiley Pub., c2005
Call No.: 364.168 LIN
Click here for item availability.
Description: In Phishing, Rachael Lininger: Offers case studies that reveal the technical ins and outs of impressive phishing attacks. Presents a step-by-step model for phishing prevention. Explains how intrusion detection systems can help prevent phishers from attaining their goal-identity theft. Delivers in-depth incident response techniques that can quickly shutdown phishing sites.

Answered by Chan Wai Ling, Librarian, Adult and Young People’s Services

Found this question interesting? What do you think?
Post your comments, or send further questions about this or any other topic to ask@nlb.gov.sg

Filed under ..Adults,..Teens,Computers & IT,Singapore Comments (0)

134 views

Pages

Recent Posts

Categories

Blogroll

Meta

Archives

What are some of the ways of identifying phishing emails?

No Comments»

Leave a comment