11/30/2009 (5:56 pm)
Roseman: Don’t fall for bait set by phishers
"Congratulations! You have been chosen by the Online Department to take part in our survey. In return, we will credit $99 to your account, just for your time."
Instead of clicking on the link in the email, he wrote to me instead.
Send it to spoof@paypal.com, I told him.
The company’s response: "You’re right – it was a phishing attempt and we’re working on stopping the fraud. By reporting the problem, you’ve made a difference."
Phishing (pronounced fishing) is a fraud designed to steal your identity. It uses false pretenses to get you to disclose sensitive personal information, such as credit card numbers or account passwords.
A common scam involves sending a fraudulent email that claims to be from a well-known company. Phishing can also be carried out in person, over the phone, through fraudulent pop-up windows and websites.
How do you spot a phishing email?
There are some telltale signs, which I verified by comparing Sio’s spoof against a genuine PayPal email I received recently (telling me the credit card used for my account had expired).
- Generic greeting. A typical phishing email will have a generic greeting, such as "Dear User." The spoof was addressed to "Dear client, PayPal." All real PayPal emails will use your first and last name.
- False sense of urgency. A phishing email will try to deceive you by saying you will be in jeopardy if your account is not updated right away. The spoof said the survey deadline was Nov. 30, three weeks after the mailing date, to avoid losing out on the $99 credit.
- Fake links. A phishing email will have a link that looks legitimate, but may send you to a fraudulent website. The spoof had a link to www.xcyg.net, which preceded the PayPal name and led me to Beijing Sunrise Technology Co. Ltd. (almost entirely in Chinese). Always check where a link is going before you click and if it looks suspicious, don’t click it.
Eric Hagedorn, an experienced eBay seller, says you should never sign into your PayPal account from a link provided by an email, no matter what the email says.
"This is how 90 per cent of all PayPal accounts get hacked – the person gives away their password to a fake PayPal site."
Always log into PayPal by opening a new browser and typing in the following, https://www.paypal.com/ca.
The term "https" should precede any web address (or URL) where you enter personal information. The "s" stands for secure. If you don’t see "https," you’re not in a secure web session and you should not enter data.
Now there’s an extra layer of security for the 8 million registered PayPal accounts in Canada – a foolproof system to prevent your account from being hacked.
The PayPal security key, which costs $5, has two forms. You can carry a small device, the size of a credit card, which lets you create a unique six-digit security code each time you log into your account. Or you can sign up to get unique security codes sent by text message to your mobile phone.
"With this in place, you can give your passwords to hackers and they’ll still be unable to break into your account," Hagedorn says.
PayPal, owned by eBay Inc., accounted for 31 per cent of company revenues in the last quarter. It’s now accepted by other online retailers such as Dell and La Senza.
Next Sunday, I’ll look at prepaid credit cards and problems that can arise when using them online.
eroseman@thestar.ca