« File Under "Haw, haw" | Main | Bogus Lottery Scammer Fails Elementary Arithmetic »

May 05, 2009

A "good" phishing story — and by "good" I mean "evil" — tries to earn the confidence of the recipient, hopefully by telling a believable story with a believable look to it. Here is an amazon.com phishing email I saw today:

Other than one unbelivable [sic] spelling gaffe in the first line, the tale is one that an unsuspecting recipient might take for being legit at face value. My email client dutifully reveals the hidden URL behind the "Click here" link, but there are probably plenty of Amazon customers who would be befuddled by the meaning behind a numeric IP address shown in this way. They might think it's a special Web location that Amazon set up just to handle these potential security issues.

The ruse of "verifying your account" is the one used most often by phishers who are seeking your login credentials to hijack your account and any credit card data associated therewith. A shopping spree at Amazon on your credit card (shipped to your "new" address) could yield some really great goodies for the crook.

Even if your liability through your credit card company is limited in terms of dollars, the hassle of getting a new card issued — and alerting all your automated payment sites to the change — is a royal PITA. In the meantime, your account data may provide the crook with enough data to open other accounts elsewhere in your name, causing difficult-to-repair problems with your credit history.

The crooks would also assume (probably correctly, alas) that you have used the same login credentials (username and password combination) at other sites, including financial institutions and other popular etailers. Robots will soon try those credentials on as many sites as possible, looking to hijack even more of your accounts.

Phishing is just another confidence game: Attempting to use a story to gain your confidence that they are sincere in trying to help you avoid fraudulent activity on your account. In truth, only by following the links and filling in the forms will you open the door to fraudulent activity on your account.