Help Combat Phishing Scammers

Generally speaking, people become victims of phishing scams simply because they do not know how such scams operate. You can help by ensuring that friends and colleagues are aware of such scams and what to do about them. You might like to point them to this web page or another resource that provides information about phishing. The power of such "word-of-mouth" education is substantial. You CAN make a difference by sharing your knowledge of phishing scams with other Internet users.

How to Avoid Becoming a Victim of a Phishing Scam

If you receive any unsolicited email from a bank or other institution that asks you to click an included hyperlink and provide sensitive personal information, then you should view the message with the utmost suspicion. If you have any doubts at all about the veracity of the email, contact the institution directly to check.

Never click on a link in an email in order to access the website of a bank or other institutions that may be the target of scammers. The safest method is to manually enter the URL of the institution's website into your browser's address bar.

What to do if you Have Already Been Tricked into Submitted Information

If you have already submitted information to scammers as a result of a phishing scam, you need to contact the targeted institution for advice immediately. It is imperative that you act quickly to protect the account that has been compromised in the phishing attack.

What to do if you Receive a Suspected Phishing Scam

• DO NOT click on any links in the scam email.
• DO NOT supply any personal information of any kind as a result of the email
• DO NOT reply to the email or attempt to contact the senders in any way.
• DO NOT supply any information on the bogus website that may appear in your browser if you have clicked a link in the email.
• DO NOT open any attachments that arrive with the email
• REPORT the phishing scam 
• DELETE the email from your computer as soon as possible.

Common Characteristics of Phishing Scam Emails

Unsolicited requests for sensitive information
The entire purpose of a typical phishing scam email is to get the recipient to provide personal information. If you receive any unsolicited email ostensibly from a bank or other institution that asks you to click a link and provide sensitive personal information, then you should view the message with the utmost suspicion. It is highly unlikely that a legitimate institution would request sensitive information in such a way.

Content appears genuine
Phishing scam emails are created to give the illusion that they have been sent by a legitimate institution. The email may arrive in HTML format and include logos, styling, contact and copyright information virtually identical to those used by the targeted institution. To further create the illusion of legitimacy, some of the secondary links in these bogus emails may lead to the institution's genuine website. However, one or more of the hyperlinks featured in the body of the email will point to the fraudulent website.

How Scammers use Information Harvested from Phishing Scams

Scammers are able to use information stolen from victims in a variety of ways. They may:

• Take over the victim's account.
  After the scammers have harvested information such as passwords, user names and account numbers, they are able to directly access the victim's account. They can then transfer funds to other accounts, conduct transactions, issue cheques in the victim's name and generally manipulate the account in the same way that the legitimate owner could. They can also change the account password so that the victim is locked out of his or her account.

How Phishing Scams Work

Phishing scams attempt to trick people into providing sensitive personal information such as credit card or banking details. In order to carry out this trick, the phishing scammers send a fraudulent email disguised as an official request for information from the targeted company. Generally, they also create a "look-a-like" website that is designed to closely resemble the target company's official site. The fake website may appear almost identical to the official site. Style, logos, images, navigation menus and other structural components may look the same as they do on the genuine website.

Recipients of the scam email are requested to click on an included hyperlink. Clicking this link will cause the fake website to open in the user's browser. Once at this fake website, the user may be presented with a web form that requests private information such as credit card and banking details, and other account data such as a home address and phone number. Often, the visitor is requested to login using his or her username and password. All information entered into this fake website, including login details, can subsequently be collected and used at will by the criminals operating the scam.