How Phishing Sites Work

Last week I blogged about how spammers evade spam filters. This week the Sydney Morning Herald is running an in-depth piece about how phishing works, and why so many people get duped by this common fraud.

Phishing, if you're new to the lingo, is the term for those phony emails you probably receive constantly from your "bank" or from "Paypal." Only they're not from any real financial institution. They're carefully created frauds designed to take you to a phony web site, where they intend to separate you from your password. You receive a message that your credit card is expiring or that you need to verify your account (there are dozens of variations on the scam), then enter your password at the phony site. Once you've done so, the system tells you that everything is OK and forwards you to the real website. Meanwhile, scammers are busy transferring funds to their accounts and cleaning you out. Boo!

Why do so many people get suckered? The problem, the story reveals, is education. People just don't know how dangerous phishing is. Also: Scammers are incredibly sophisticated, and the best phishing site fooled 90 percent of those tested in one of the SMH's experiments.

What to do? As always, my advice is to never, ever click on a link you receive via email. If you think a message might be legitimate, simply type the address into your web browser or use a bookmarked address that you know is good. When you get to the real web site, any account updates or expiring credit cards will be noted on the screen.

And for God's sake, get a good spam filter.