Phishing FAQs

This page contains answers to frequently asked questions about Phishing Scams.

1. What is phishing?

Phishing is just what it sounds like"fishing." Only instead of sporting for fish, phishers try to bait a sea of Internet users into giving them personal - and usually financial - information. Criminals spam thousands of computer users with spoofed emails and copycat websites designed to fool you into revealing data such as credit card numbers, account usernames and passwords, social security numbers, etc.

2. Why is it called phishing?

Sometimes it's said the term "phishing" stands for "password harvesting fishing." Most likely that acronym was coined retroactively. The term probably comes in the analogy that these phishing scam artists are fishing for victims: they throw out a ton of bait - spamming all those copycat emails - and only need a few people to bite. As for the "ph", that's a common hacker replacement for "f," and a nod to the original form of hacking, known as: "phreaking."

3. What does phishing look like?

Usually, a phishing email will seem to come from a trustworthy company. To gain the viewer's trust, phishers will hijack logos, letterheads, and include hyperlinks within the email that appear to redirect you to the company's official site.

4. How does phishing work?

Typically, a phishing email will seem to come from a trustworthy company - maybe a well-known bank or online retailer - and contain a message intended to alarm you into taking action. In common phishing scams, the emails use pressure tactics, by warning that failure to respond will result in you no longer having access to your account. Other emails prey on fear, claiming that the company has detected suspicious activity in your account or is implementing new privacy software or identity theft solutions. Then the same email provides a convenient link to take you to a copycat website. Now at that page, you're prompted to enter personal information, which is then captured by the fraudster.

5. How do phishers get my email address?

Phishing emails are just like spam - they're largely sent at random. Spammers gather emails from all over the web: websites, newsgroups, legal and illegal mailing lists, etc. Sometimes it's simply guesswork. The email addresses aren't ever gathered from the companies that are spoofed in phishing, unless that information is somehow stolen.

6. Is it safe to use online banking and buy things from the Internet?

Online banking and ecommerce is generally safe and convenient. Still, you should never relax your guard online, and treat unsolicited emails as suspiciously - if not more - as you'd treat an unsolicited phone call or stranger knocking at your door. Click here for tips on how to protect yourself from phishing and online fraud, including the use of firewalls and anti-virus software.

7. How do I protect myself?

The golden rule to avoid being phished is to never hit "reply" or click the links within a suspicious email. If you can tell it's phishy, always delete the email immediately. Once you've done that, and deleted the phishing email, empty the trash box in your email program as well. If you're not sure whether the email is legitimate or fake, be suspicious of any emails that request financial or personal information, especially ones that prey on fear or use pressure tactics. If you have reason to believe that a financial institution really does need personal information from you, call the company yourself - using the number in your phone book, not the one the email provides. Also, rather than just clicking on the link provided in the email, type the company's official web address into your web browser yourself, or use a bookmark you previously created. Even though a URL in an email may look like the real deal, fraudsters can mask the true destination.

8. Where do I find more information on how to protect my personal and financial data?

Personal firewalls and security software packages protect a computer network from unauthorized access, making them a must-have if you engage in online financial transactions. Use anti-spam, anti-virus, and anti-spyware software, like SpyHunter, which will clean your system of Active X - a technology popularly used in phishing scams. Also, consider installing a web browser tool bar to help protect you from known phishing websites.

9. How do I report suspected phishing attempts?

If you receive a phishing email, immediately forward it to the company that is involved. You can also file complaints with the Federal Trade Commission and forward them the email as well, at spam@uce.gov. This will help everyone - you, other Internet users, companies, everyone - protect and fight against phishing attacks.

10. What should I do if I've responded to a phishing email or website?

If you've responded to a phishing email and think you may have compromised personal identification or financial information, don't panic - but you'll need to act immediately. Notify your bank, credit card issuers, and credit reporting agencies, and ask them to flag your account and watch for unusual activity.