Phishing

Rest Assured!

We will never initiate a request to gather personal, confidential and/or financial information from you via telephone, e-mail, website or print.

Avoid Phishing Scams - Protect Your Identity

Phishing scams are more than just unsolicited and annoying spam – they could lead to the theft of your credit card numbers, passwords, account information, or other personal information.

What is Phishing?
Phishing is a type of deception designed to steal your identity. In a phishing scam, a malicious person tries to get information such as credit card numbers, passwords, account information, or other personal information from you by convincing you to give it to them under false pretenses. Phishing schemes usually come via spam e-mail or pop-up windows.

How does Phishing work?
A phishing scam begins with a malicious user who sends out millions of fraudulent e-mail messages that appear to come from popular websites or from sites that you trust, like your bank or credit card company. The e-mail messages, and the websites they often direct you to, look official enough that they deceive many people into believing that they’re legitimate. Believing that these e-mails are legitimate, unsuspecting people too often respond to the e-mail’s request for their credit card numbers, passwords, account information, or other personal and confidential information.

A scam artist might put a link in a fake e-mail that appears to go to the legitimate website, but actually takes you to a scam site or even a pop-up window that looks exactly like the official site. These copies are often called spoofed websites. Once you’re at one of these spoofed sites or pop-up windows, you might unwittingly enter even more personal information that will be transmitted directly to the person who created the spoof site. That person can then use this information to purchase goods, apply for a new credit card, or steal your identity.

Just as they do in the physical world, scam artists will continue to develop new and more sinister ways to trick you online. Following the five steps below can help you protect your personal information.

Five Ways to Protect Your Identity

1. Never respond to requests for personal information via e-mail or in a pop-up window. When in doubt, contact the institution that claims to be sending the e-mail or pop-up window.
2. Visit websites by typing the URL into your address bar.
3. Check to make sure the website is using encryption.
4. Routinely review your credit card and bank statements.
5. Report suspected abuses of your personal information to the proper authorities.

A detailed explanation for each of the five ways to protect your identity is outlined below.

Step 1: Never respond to requests for personal information via e-mail
Legitimate businesses should never ask for passwords, credit card numbers, or other personal information in an e-mail. If you do receive an e-mail requesting this kind of information, do not respond. If you think the e-mail is legitimate, contact the company requesting this information by phone or through their website to confirm that the request is legitimate. See Step 2 below for the best ways to get to a website if you think you’ve been targeted by a phishing scam.

For a list of sample phishing scam e-mails people have received, check the Anti-Phishing Working Group Phishing Archive.

Step 2: Visit websites by typing the URL into your address bar
If you suspect that an e-mail from your credit card company, bank, online payment service, or other website you do business with is not legitimate, do not follow the links to the website from an e-mail message. Those links may take you to a spoofed site that might send all the information you enter to the scam artist who created the site.

Even if the address bar displays the correct address, don’t risk being fooled. There are several ways for hackers to display a fake URL in the address bar on your browser. Newer versions of Internet Explorer make it more difficult to spoof the address bar, so it is a good idea to visit Windows Update on a regular basis and update your software. If you don’t think you’ll remember to update or if you prefer to have the updates downloaded automatically, you may be able to configure your computer for Automatic Updates.

Step 3: Check to make sure the website is using encryption
If you can’t trust a website by the address bar, how do you know it’s likely to be secure? There are a few different ways. First, before you enter any personal information, check to see if the website uses encryption to transmit your personal information. In Internet Explorer, you can do this by checking the yellow lock icon on the status bar as shown in the following illustration.

Secure site lock icon. If the lock is closed, then the site uses encryption.

This symbol signifies that the website uses encryption to help protect any sensitive personal information – credit card number, social security number, payment details – that you enter.

Double-click the lock icon to display the security certificate for the site. The name following “Issued to” should match the site you think you’re on. If the name differs, you may be on a spoofed site. If you’re not sure whether a certificate is legitimate, don’t enter any personal information. Play it safe and leave the website.

To find out more ways to determine if a site is safe, read How Internet Explorer Keeps Your Data Safe.

Step 4: Routinely review your credit card and bank statements
Even if you follow the three steps above, you may still become a victim of identity theft. If you review your credit card and bank statements at least monthly, you may be able to catch a scam artist and stop them before they cause significant damage.

Step 5: Report suspected abuses of your personal information to the proper authorities
If you feel you have been a victim of a phishing scam, you should:

• Immediately report the scam to the company that is being spoofed. If you’re unsure how to contact the company, visit the company’s website to get the correct contact information. The company may have a special e-mail address to report such abuse. Remember not to follow any links in the phishing e-mail you received. You should type the know website address for the company directly into the address bar in your Internet browser.
   
• Provide details of the scam, such as the e-mails you received, to the FBI through the Internet Fraud Complaint Center. The center works worldwide with law enforcement and industry to promptly shut down phishing sites and identity theft perpetrators behind the fraud.

If you feel your personal information has been compromised or stolen, you should also report the circumstances to the FTC and visit the FTC identity theft website to learn how you can minimize the damage.