« Apple ID Password Message | Main | The Power of Coincidence »

April 05, 2012

If you are a Facebook user, the format of the following message will certainly look familiar to you:

It's a dead ringer for the real thing. You won't know the person requesting your friendship, so the first instinct is to click on the person's name to view their profile (or perhaps you're so desperate to increase your friend count, you click the Confirm button without thinking). No matter which link you click in this message, if your PC isn't fully protected and patched, it (and all your active login credentials) will soon belong to some crook.

Each link in the above message goes to a different hijacked web site, where an obfuscated JavaScript script starts your PC on its way to hell. If you've been reading this Spam Wars Dispatches blog recently, you'll recognize a pattern in the multiple links to malware loading web sites. What's a bit different in this one is that instead of frightening you to click a link, this message uses your typical response to a familiar email from a source you probably trust (although inherently trusting Facebook is perilous in itself).

So, how can you tell if this is phony?

Two ways:

1. The easiest way is to hover your cursor atop each of the links without clicking. In most email readers, you will see a tooltip showing the URL of the link — in this case, definitely not to facebook.com. (BTW in the email client on iOS devices, you can press and hold on a link to get the same kind of popup revealing the URL. Just be sure to cancel the popup, rather than navigating to the link.)


2. I'm also an advocate for learning how to read email message headers to spot when the sender isn't who it claims it is in the From: field you see in the message. Almost everything in an email header can be forged without consequence to the sender. Understanding what's true is vital to interpreting headers and avoiding being scammed.

It is email messages like this one that leads me to distrust every piece of email until I can satisfy myself that it is genuine. As is proven here, crooks count on your automatic response to familiar things. Be smart about it.