Phishing
Pronounced “fishing,” it is a scam to steal valuable information such as credit card and social security numbers, user IDs and passwords. Also known as “brand spoofing,” an official-looking e-mail is sent to potential victims pretending to be from their ISP, bank or retail establishment. E-mails can be sent to people on selected lists or on any list, expecting that some percentage of recipients will actually have an account with the real organization.
E-Mail Is the “Bait”
The e-mail states that due to internal accounting errors or some other pretext, certain information must be updated to continue your service. A link in the message directs the user to a Web page that asks for financial information. The page looks genuine, because it is easy to fake a valid Web site. Any HTML page on the Web can be copied and modified to suit the phishing scheme.
Anyone Can Phish
A “phishing kit” is a set of software tools that help the novice phisher imitate a target Web site and make mass mailings. It may even include lists of e-mail addresses. How thoughtful of people to create these kits.
Spear phishing is more targeted and personal. The e-mail supposedly comes from someone in the organization everyone knows such as the head of human resources. It could also come from someone not known by name, but with a title of authority such as a LAN administrator. Once one employee falls for the scheme and divulges sensitive information, it can be used to gain access to more of the company’s resources.
If you need help contact Steve Dunton at
duntonsr@mckenzie-thorpe.com
Discussion Area - Leave a Comment
You must be logged in to post a comment.