|
||
More sophisticated attempts targeting specific people or groups are called spear phishing, indicating the attempt is made at a smaller target and has enough information to appear more plausible to the victim.
The most common phishing technique is to pretend to be Ebay, Paypal or an online bank. Mail is sent to the prospective victim pretending to be an official communication. The victim is asked to use a link provided to log in and present the requested information. HTML tricks are used to hide the actual URL, or a similar but fraudulent URL is provided. If the victim follows the link and inputs the information, all they have done is provide the villain with the information to exploit.
A rising technique is to use social networking sites such as Myspace. The personal information present provides a handy source of data to exploit in attempts to seem legitimate, and estimates say such attacks are 70% successful at this time.
A new and very sophisticated method uses website scripting to provide an almost perfect representation of the legitimate website, difficult for even an expert to tell from the real thing.
So, what can be done? There are legal and technical responses underway, but these are things the average user will not have available for the near term. Instead, training is normally the response. The first step is never to follow the link provided. Always look up the correct link and type it in manually, or follow it through a reputable search engine. If the attempt looks plausible enough, go to the real company website, not using any links provided, and look up contact information to ask about the message. Do not trust any email provided in the suspect message.
Another option for those who are using a reasonable email program is simply to read the message as text, and see if the links are formatted normally or possess a “@” symbol, or if there is a link and then another in “” that does not match. Finally, users can be trained to pay attention to details. Simply observing messages known to be from the legitimate source can let you know when something is missing or added that does not fit. This can be a partial account number or other personal information.