avoiding_phishing

Identity theft has rapidly become the fastest growing crime in the nation and those behind such dubious acts continue to create new ways to steal your information. This crime isn't limited to individuals — small-business owners need to take measures to protect their companies as well.

One way for criminals to acquire your personal or business information is by getting you or your employees to voluntarily offer the "keys" — federal tax ID numbers, credit card or bank account information, etc. Consumers are not likely to just volunteer this information, so the criminals try to deceive people into submitting the necessary data. This is done is by "phishing."

Phishing is the act of sending mass emails claiming to be from a legitimate business but directing consumers to a "mock" or "replica" of a legitimate web site. The site requests an update of account information such as a Social Security number or bank or credit card account numbers.

Phishing scams usually are sent through a mass email that asks the recipient to respond or click a link that automatically directs the person to the mock site. The type of bait may vary, but the hook is always the same. Recipient are asked to update their personal information or suffer some false consequence — a suspended account or drop in service. Another type of bait is to offer something free for an immediate response.

"We suspect an unauthorized charge to your account. To ensure your account is not compromised, please click the link below and update your current information."

Here are several tips suggested by the Anti-Phishing Work Group to avoid falling prey to a phishing scam:

Be suspicious of any urgent claims to update business or personal account information. Most companies will never ask to obtain personal information — most of which they already have — through an email.

Never use links included in the email. If you receive notice from your bank requesting an update of your account information, open a new web browser instead and go directly to the bank's web site.

Pick up the telephone and call the company in question. The person on the other end of the phone will more than likely be able to direct your call to the appropriate destination.

Is the message personalized? Phishing scams are generic by nature. It would dramatically reduce the chances of a "bite" if the message said "Dear Bob Smith."

Never directly reply to a suspicious email with personal account information. Log into the company's secure web site, or use the telephone if an update is necessary. To see if the web site you are logging into is secure, look at the URL at the top of the page. If it's a secure web site, the address will have an "https://". Unsecured sites are simple "http://". You also can look at the bottom right-corner of the page to see if there is a lock icon.

Use anti-phishing software. There are a number of freeware programs on the Internet that you can download. These programs will check the web address in question against a list of known phishing scams and notify you if the site appears there.

Update your business's computers with the latest upgrades and security patches. Some phishing sites are able to obtain your information through your IP address if you simply visit the site.

Review statements. Always look over credit card and bank statements for suspicious charges and question anything you don't recognize.
If you think your business has become a victim of a phishing scam, file a complaint with the Federal Trade Commission (http://www.ftc.gov/).