Recent Articles

Thieves Don't Take a Holiday

Vishing

Phishing/
Email scams

Three New Scams

Tips for Spotting Fraud

What's on Your Driver's License?

ATM Safety Tips

Fraudulent Lotteries

Spotting Fraud

Spoofing URLs

Wireless Network Security

Spyware

Keyloggers

Your Social Security Number

Spoofing URLs

Identity Safeguards © July 2004

Phising scams that pilfer sensitive account information from unsuspecting victims are on the rise. An essential part of the deception is a carefully “spoofed” email or web address.

Spoofing is a technique that masks a web address so it appears to originate from a legitimate company or organization. This can be done simply or with complicated web coding. For instance, the link http://www.ebay.com will direct you to the Identity Safeguards homepage, not Ebay.com. It’s a simple trick, and it can be performed by anyone with a basic understanding of the web.

Other scams use URLs that contain subtle misspellings to deceive the casual surfer. You might receive the following link in an email: “support.citybank.com.” If you’re not paying close attention, you might click the link, get directed to a convincing copy of the Citibank website, and unwittingly hand over personal account information.

Many spoofing techniques rely on “holes” in internet browser programs that allow crooks to manipulate the details of a website. A recently discovered hole in Microsoft’s Internet Explorer gave scammers the ability to display a false URL in the address bar of the browser. Thieves were able hide the telltale signs of a phising scam, making their deception particularly dangerous. The address bar might display “www.identitysafeguards.com”, but the actual page and address is really part of a phising scam. Companies, like Microsoft, release “patches” to fix browser vulnerabilities. Unfortunately, many people neglect to update their software and are susceptible to the deception.

Remember, the key to any phising scam is the crooks ability to convince a person that they are visiting a trusted website when they’re really viewing a fraudulent copy. Verifying a link before it is clicked is an important step in guarding against fraud. It may be difficult to determine the legitimacy of a link, but there are tools that can help. SpoofStick is a free program that displays the actual URL of a website, even if it is being “spoofed” to look like something else. Simple anti-spoofing programs like SpoofStick can give a person greater confidence when surfing the web. As with most scams, the best defense against spoofing and phising is attention to detail. If there is any doubt about an email, don’t click the link and visit the company’s website by typing the URL directly into the address bar.