Phishing: Examples and its prevention methods

Phishing is an e-mail fraud method in which the sends out legitimate-looking email in an attempt to gather personal and financial information from recipients. Phishing can attempting to criminally and fraudulently acquire sensitive information, such as usernames, passwords and credit card details, by masquerading as a trustworthy entity in an electronic communication. Normally, the messages appear to come from well know and trustworthy Web sites. Web sites that are frequently spoofed by phishers include Pay Pal, eBay, Yahoo, MSN and online banks are common targets. Phishing is an example of social engineering techniques used to fool users. Attempts to deal with the growing number of reported phishing incidents include legislation, user training, public awareness, and technical measures.

The email below is the example of phishing:

"Phishing" -- Sample bogus e-mail from Citibank:

Example for Pay Pal:Example for Wachovia email:

There are some menthods to prevent Phishing:

1. No attempt to prevent information leakage. Rather, try to detect and then rescue users from the consequences of bad trust decisions.

2. Harness scale against the attacker instead of trying to solve the problem at each client. Thus scheme increases in efficacy with the scale of deployment: it offers very little protection if a small fraction of users participate, but makes phishing almost impossible as the deployment increases.

3. Verifying the authenticity and security of Web sites, particulary EC sites.

4. Securing computer before shopping online by keeping antivirus, antispam, and firewall software up-to-date.

5. Never following directions asking you to reveal information or delete a file that is received in e-mail or pop-up messages from seemingly trusted companies.

6. Never replying to e-mail or pop-up messages from companies that ask for personal, financial, or password information.

7. Reviewing credit card and financial statements for unauthorized charges.

References:

- http://www.bankrate.com:80/brm/news/advice/Phishing-email.asp
- http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci916037,00.html
- http://www.wachovia.com/misc/1,,1856,00.html
- http://en.wikipedia.org/wiki/phishing

Prepared by: Koh Kah Wang