Online fraud can occur when a criminal poses as a legitimate company or business in order to obtain sensitive personal data and then illegally conducts transactions on your existing accounts. These scams are often called “phishing” or “spoofing.”
Phishing
Fake emails (phishing) will often…
- Ask for personal information. They may claim that your information has been compromised, that your account has been frozen or ask you to confirm the authenticity of your transactions.
- Appear to be from a legitimate source. While some emails are easy to identity as fraudulent, others may appear to be from a legitimate address and trusted source. You should not rely on the name or address in the “From” field, as this is easily altered.
- Contain fraudulent job offers. These are often work-at-home accounting positions.
- Contain prizes or gift certificate offers. In exchange for completing a survey or answering questions, some fake emails promise a prize or gift certificate. They require you to give personal information in order to obtain the prize.
- Link to counterfeit websites. Fake emails may direct you to counterfeit websites that closely resemble a legitimate site while they collect personal information for illegal use.
- Link to real websites. Some fake emails link to legitimate websites. This is done in an attempt to make a fake email appear real.
- Contain fraudulent phone numbers. Never call a number featured on an email you suspect is fraudulent; it can be tied to the fraudsters.
- Contain real phone numbers. Similar to linking to real websites, real phone numbers may be featured in a fake email in an effort to make the email appear legitimate.
Below are three simple rules, recommended by the Department of Justice, to follow when you see emails or websites that may be a part of a phishing scheme:
Stop
Phishers typically include exciting or frightening (but false) statements in emails with one purpose in mind: they want you to react immediately and impulsively. Resist! No matter how exciting, attractive or worrisome the statements or claims in the email seem, take time to check out the information closely before acting.
Look
Always look closely at any claims made in an email. Think about whether the claims make sense and be highly suspicious if asked to share personal information such as account numbers, usernames or passwords.
If you receive any email claiming you’ve won a prize or are entitled to receive some special “deal,” there is reason to be highly suspicious, especially if you’re asked to share confidential personal information. You’re much better off erring on the side of caution, which leads to the following point.
Call
When you receive a suspicious email that claims to have originated from a legitimate company or financial institution, call or email that company or institution – using a phone number or email address you know to be valid (not a phone number in the email!) -- and investigate. Credit card account holders can call the toll-free customer assistance number on the back of their card and bank customers should use a phone number listed on one of their bank statements.
Spoofing
Web-site spoofing is a method of creating fraudulent websites that look similar, if not identical, to an actual site, such as that of a bank. Online thieves often direct you to fraudulent websites via email and pop-up windows fooling you into entering information such as an Internet banking username and password, card information or other information that a criminal can use to fraudulently use your account or steal your identity.
Follow these tips to protect yourself against spoofing.
- Use caution when you receive any e-mail requesting personal and/or card account information.
- Avoid clicking on links in e-mail messages. Go directly to the company's website by typing the address into your browser address bar and submit the information there.
- Ensure that web sites are secure by checking to see whether there is an "s" after the http in the address and a lock icon at the bottom of the screen. Both are indicators that the site is secure.
