How to Detect Phishing

Email phishing is a global crime.

"Phishing" refers to any email that attempts to trick you into revealing your private information, such as passwords, identification numbers, account numbers and date of birth for the purpose of stealing your identity. Internet identity theft nets criminals billions of dollars annually. Unless you're careful about sharing personal information online, your identity, your user accounts and your money are at considerable risk.

Instructions

1. Read any email that asks you for personal information carefully. Frequently, the phishers make grammatical or typographic errors in the text or images in the email. These errors typically do not occur in professional documentation from trusted business partners and banks.

2. Refrain from entering personal data on email reply forms. Legitimate companies never contact you by email to ask for personal information already on file with them.

3. Hover your mouse over any link to confirm that it matches the sender's "From" address. For example, if the sender's email address is "[e-mail]" but the clickable link in the email shows "http://www.phishermen.com," you can be sure the message does not originate from the bank.

4. Close the email without clicking any links and forward it in its entirety to your ISP's abuse center. While commercial ISPs may vary in their treatment of internet abuse, most have effective spam and phishing blockers that can prevent future phishing attempts from suspect domains.

5. 

   Don't leave phishing emails in your mail box or trash bin.

   Delete the email from your inbox, then clear it out of your trash bin so that you don't re-open it and accidentally click one of the phishing links.

Tips & Warnings

• If you feel the email might originate from a legitimate source, type the link address manually into your browser's URL bar. Legitimate addresses will include security measures such as secure HTTP, challenge questions, and so on.

• If you suspect you're being phished, call the company or financial institution that supposedly sent you the email and report it to them. They have resources they can use to find and prosecute scammers.

• If you do fall for a phishing scam, contact the company or financial institution immediately to let them know about the possibility of a compromise in your account, and change as many account passwords as you can.

References

• Plan B Security: Phishing Detection and Prevention (PDF)
• Spam Laws: Detecting Phishing
• IDTheftHelpCenter.com: How to Detect Phishing Spam
• Spyware Remove: How You Can Prevent Phishing Scams

Resources

• Privacy Rights Clearinghouse: Identity Theft Survey and Studies
• Fight Identity Theft: How to Report Phishing Scams
• Fight Identity Theft: Recovery Guidelines