I had an email message from my bank today. "Dear valued Citizens Bank member", it began, "Your account information needs to be updated to protect your account and reduce the risk of fraud. Failure to confirm your records", it went on, "may result in your account suspension." Hmm, that's a bit worrying, I thought. Still, easy enough to click their button, put in my name and password and all would be well. My mouse pointer hovered over the link when I stopped: I don't even have a Citizens Bank account.
I was on the receiving end of a phishing attack, a fraudulent attempt to get hold of my bank details. It is the fastest growing form of internet fraud, and if you have an email account you almost certainly have received one of these. Some look very convincing indeed, and no-one knows how many people have been taken in by them. In this case it was easy for me to spot, because I had no connection with the bank in question. If you do click that tempting button you will see a web site that looks quite like your bankås real website and it will ask you to enter your security information. And if it is a phishing site, that is the green light for them to go fishing in your bank account.
So how do you spot the frauds and protect yourself from emails like this? The sad fact of modern life is that you canåt really stop these emails. Luckily there are some simple things you can do to protect yourself.
Start by being skeptical of anything that comes your way asking for bank details. If you donåt have an account at that bank, itås a fraud. Real email messages from real banks will never ask you to enter security information. If the English is bad or the pictures are not displayed properly, itås a fraud. If the email is addressed to someone else or a lot of people whose names are a bit like yours, itås a fraud. If it doesnåt have any contact information for them that you can check, itås probably a fraud. All in all, if it seems a bit suspicious, it probably is.
However these frauds are not very clever, and canåt do you much harm unless they trick you into putting your username and password on their website.
If you use internet banking, visit your bankås website. Read what they say about avoiding the scam-merchants - they will often have information about any specific phishing exploits that they have discovered. And be assured that your real bank will never send you a message like the ones the phishermen send.
You can test your skill as a phish-spotter: there are quizzes on the internet where you get to decide whether emails are legitimate or phishing frauds. As well as flexing the little grey cells they give some great tips for distinguishing between rogue and real emails. Here is one: http://survey.mailfrontier.com/survey/quiztest.html