In a previous issue, we discussed ways in which to protect



ourselves from fraudulent business offers, cons, and "grifts",

as well as how to recognise when you are being conned.

In this issue, we will be dealing with a much more insidious and

frightening threat. Identity theft.

Why is it that we say this threat is more frightening than a case

of simple fraud? Well, most cases of fraud are quick "hit and

run" schemes that will result in a loss of several hundred or

even thousand dollars, after which the perpetrators typically

disappear with your money and are never heard from again.

In cases of identity theft, though, the perpetrator doesn't just

go away. They continue to plague you. If fact, they continue to

BE you, by stealing access to your bank accounts, PayPal account,

Clickbank, Forex, or any other financial resource you can access,

especially the ones you can access online. And once they've taken

control of these resources, it can be incredibly difficult to rid

yourself of the perpetrator. In fact, just trying to convince angry

creditors that you ARE YOU, and they are not, can be very time

consuming and difficult.

Additionally, some victims never even realise they've become a

victim of identity theft until one day their credit has been revoked

for some debt their doppleganger has run up, or for back taxes that

haven't been paid for years. This can obviously be devastating.

The Latest Generation

---------------------

The newest threat comes via the same route as so many others do

these days - email. This has been termed "phishing". Phishing is

any attempt to gather your login and password for illegal

financial or personal gain through electronic means. Once this

information has been gained, they may easily gain access to your

financial accounts.

Here is a serious point that MUST be mentioned: If a criminal can

gain access to one financial institution, they may gain access to ANY

INSTITUTION THAT IT INTERACTS WITH.

Let's examine just ONE potential avenue of attack: PayPal

accounts. First, let me state that PayPal is incredibly diligent

in protecting their clients, as are all institutions of a similar nature.

Paypal is extremely secure under most circumstances, and this

example does not imply that their security is weak. I personally

have a PayPal account, and trust their system implicitly.

To continue with our example...

For instance, if you have your PayPal account compromised by a

person phishing you for your login and password, then they have

access to not only your Paypal account, but to any credit cards

or bank accounts associated with your PayPal account.

In other words, if you are an online vendor, and you have money

accrued in your Paypal account, a successful scam to obtain your

login information will not only yield the positive balance in

your Paypal account, but they may also debit your bank account

and credit cards. This allows them to completely drain all three

resources, and send the funds to their own account.

An efficient defrauder who has the appropriate tools can send out

hundreds of thousands of fake emails PER MINUTE. Millions

per hour.

Even if they use a highly inefficient to collect data, they may hit

upon an incredible number of valid email account names, typically

from the major free email providers.

With good tools and a bit of know-how, this will be pretty much

undetectable by their ISP.

Now the attacker has (a) sent out millions of fake emails, and

(b) created a list of valid email addresses that he can use for

attacks, ie, potential victims.

If the attacker even a 2% response rate will yield THOUSANDS

of successful phishes. All those logins and passwords will be

saved for future reference.

Finally, over the course of a short period, say 2 or 3 nights,

the thief will act. If two or three people work together, as is

common, they can take the funds from probably in excess of

a thousand victims per hour.

The email list they've made can be used again and again to get

anybody they may have missed in the previous run.

Feel safe yet?

Fortunately, this magnitude of theft is rare. More often than not

the thief is either less capable, or is content with a much less

ambitious attack.

Still, if you're the one they hit, it still stings just as much.

Am I At Risk?

-------------

As usual, those who have a website or business online are the

highest risk - if they accept Paypal, Clickbank, or whatever,

the perpetrators can easily tell simply by creating a transaction

through your website. They needn't complete the transaction,

either. Long before it's complete, they can tell what the ID is

of the business using the financial service in question.

For that matter, a lot of site owners have their ID visibly

coded into their buttons and links. It's easy to obtain your

account ID if that's the case.

Eventually, you will receive emails saying things like "We

suspect an unauthorized transaction on your account. To ensure

that your account is not compromised, please click the link

below and confirm your identity." Or perhaps, "During our regular

verification of accounts, we couldn't verify your information.

Please click here to update and verify your information."

Often you are told that they have detected abnormal account

activity, or that your account has been accessed from somewhere

overseas. I've gotten one that said someone in France had tried

to access my account.

The frightening thing is that these emails are ALMOST impossible

to distinguish from a genuine email from that company, because

the criminals in question have taken great pains to duplicate

the exact format these companies use for their messages,

including logos and nearly identical web addresses. Holding your

mouse over the links will even show a mouseover box with the

real company's web address, adding to the authenticity of the

lie.

So, if you receive a comminuque from your payment processor or

banking institution, how should you proceed?

Is This Email For Real?

-----------------------

Firstly, none of the real banking institutions or payment

processors will EVER, EVER, EVER ask you to click a link to log

into your account, or ask you to enter you user name and password

via either EMAIL OR PHONE. Anyone who does is NOT the genuine

article.

DO NOT EVER CLICK ON A LINK THAT HAS BEEN PRESENTED

TO YOU ASKING YOU TO LOG INTO YOUR BANK, CREDIT

CARD COMPANY, OR PAYMENT PROCESSOR WEBSITE.

All such links are an attempt to steal your login and password.

Secondly, the emails will typically use either just your first

name or your email address in their salutation, since this is

normally all the information they can get about you. Sometimes

they will use your business name.

Banks and other institutions will identify themselves to you and

greet you by your complete, full name. This aids you in

identifying them as genuine.

WARNING: This does not always work, since some people make the

mistake of posting their full name on their website in the same

format as it appears on the statements from their financial

institutions. That means it's now public domain, and the person

trying to trick you may now have access to your full name, which

they will then use to aid in looking more genuine.

Thirdly, most payment processors have an address you can forward

emails to in order to verify their authenticity. If you receive

a questionable email, forward it to this address in order to let

your institution know that you've received it, and to verify

whether it's genuine.

What If I Receive Such An Email?

--------------------------------

First, if you've received such an email, do NOT click the link.

Secondly, forward the email to spam@uce.gov, and also to the

company, bank, or financial institution that the con artist has

attempted to impersonate. For example, spam@paypal.com

Thirdly, delete the email without any delay.

What If I've Already Become A Victim???

---------------------------------------

Unfortunately, sometimes information doesn't arrive in time, or

a new form of attack is developed befroe the word can get out.

Every year, thousands of people are still victimised by identity

thieves, and their livelihood or bank accounts are compromised.

What should you do if you suspect you've become another victim of

this form of theft?

According to the FTC, the following steps should be your

imediate response:

-Placing Fraud Alerts on Your Credit Report

-Closing Accounts

-Filing a Police Report

-Filing a Complaint with the Federal Trade Commission

Filing An Identity Theft Report

You can find details about how to perform each of these steps by

visiting the FTC site, by subscribing to our newsletter, or visiting our

website.

Until our next issue,

Chris McKay, Editor.

----------

If you have questions, comments or suggestions for our

newsletter, please send them to editor@ultrasales.org

You can subscribe to our newsletter by visiting us at

the ultrasales.org homepage.