Citibank & Ebay - Tips On Spotting Fraudulent Web Sites
By Parry Aftab, InformationWeek
Server Pipeline

Here are some tips from an Internet service provider
eBay, and Citibank on Ways To Avoid Being Phished

Citibank Tips

Citibank warns its customers to check the security certificate for any site to which they're linked.

If the name doesn't match the company owning the site, you shouldn't trust the link. It also recognizes that not all certificates are held in a name recognized by consumers accessing the site, but the bank informs its customers that all security certificates for Citibank's sites are held in its "Citibank" name.

Since not all security certificate issuers police similar-sounding "brand-related" names when issuing their certificates, knowing the exact name of the security-certificate holder is key to authenticating the page. All sites should disclose the correct security-certificate holder name at their sites.

EBay Tips

EBay teaches its members how to spot a fake eBay URL by checking the browser Web-address window. (Although, given the Microsoft Internet Explorer vulnerability that permits the URL appearance in the browser window to be spoofed, this tip may be ineffective for IE users.)

Here's how to be sure you're on an eBay page: Before signing in, check the Web address in your browser. If you click on a link in an E-mail, verify that the Web address in your browser is the same as the address shown in the E-mail.

The Web address of most eBay sign-in pages begins with http://signin.ebay.com/. Never type your eBay user ID and password into a Web page that doesn't have ".ebay.com" immediately before the first forward slash (/)."

Examples of real eBay addresses: http://cgi3.ebay.com/ http://arribada.ebay.com/

Examples of fake eBay addresses: http://signin.ebay.com@10.19.32.4/ This domain name was recently registered\purchased

I sought the assistance of members of the Internet Society's IETF list in trying to come up with better tips on avoiding phishing and spoofing schemes.

Dean Anderson, who owns and runs an ISP in Boston, explained the basics best, so I want to share his tips with you.

EBay, the FTC, Citibank, and consumer-advocacy groups advise to make sure you're using a secure server connection. Dean comments on the wisdom of that tip and ****s that can be exploited by the con artists.

"When you connect to a secure Web site, you can examine the SSL Certificate for the site, usually by clicking on the 'lock' symbol on many browsers," he says. "People should learn how to do this and make it a habit of doing so when they connect to secure sites, so they recognize when something changes.

"Unfortunately, like other components of scams, the certificate might have a similar-sounding name. You think you've got (e.g., PayPal.com), but you got paypal-business.com. The certificate (we assume for argument) really does belong to an entity called paypal-business.com, but is paypal-business.com the same as PayPal? You don't know.

"The best thing to do is start from (e.g.) paypal.com from your account statement, etc., and examine the site certificate. Then you have a good chance that it's not spoofed. But it is only a chance, as it could still be spoofed in various ways. There are lots of scenarios for this, but here's one: Your computer could be infected with a virus which installed a Web proxy, then the attacker sends you a message to go update your stuff. You type in paypal.com, but your infected browser goes to the fake site instead. When you try to view the certificate, your infected browser shows you the real certificate information. You can't easily know this didn't happen. But examining the certificate is a good practice.

"So there are things to do that will make the con artist's job harder, but you can't make it impossible to be conned. Hopefully, the police will be able to track down the con artists, and by doing so, will deter others. "There's no perfect system, so we can't give any assurances that there is a perfect system. Nor is the case that if you do or don't do certain things, you can't be victimized. The best we can do is tell people to use their common sense, so they aren't victimized by the lowest grade of con artists."

http://www.serverpipeline.com/howto/...o=2&queryText=

Bank of America - Recognizing Emails and Websites Fraud

One of the most common types of email fraud is the practice of sending a phony email message, which is sometimes referred to as "phishing." Such phony emails are disguised as legitimate, and often include company logos that look real.

But they're actually from criminals who send thousands of emails at a time to random addresses. These criminals are trying to entice you to visit a phony website and provide personal and confidential information, such as online IDs and passcodes, or Social Security numbers and account numbers. Although the site may look like a bank's, it is not - which is why this practice is known as "spoofing."

The Account Manager or Money Transfer Agent is one of the newest scams. An email or an advertisement on the web tries to recruit you to be an account manager or transfer agent for a fictitious company. These scam artists steal money from an unsuspecting person's account and transfer the money into your account. Then the criminals ask you to send the money to them. The lure is that you get to keep a percentage of the money as your "commission." This opens your personal holdings to fraud - and, if your account is used in an online scheme, you can be liable for lost funds.

Spotting phony email messages is not always easy. Sometimes, they may ask you to reply directly, or provide a link that takes you to a website that appears legitimate but is not. In either case, these phony email messages generally ask you to provide sensitive personal, financial, or account information. See an example of a fraudulent email.

More tips for spotting fraudulent emails:

• Fraudulent emails are trying to trick you in to providing your personal information. Bank of America emails will never ask you to reply to an email with any personal information or data, such as your Social Security number, ATM or Check Card PIN, or any other sensitive information. In addition, when you sign in to Online Banking always make sure to look for your SiteKey.
• Urgent appeals claim that your account may be closed if you fail to confirm, verify, or authenticate your personal information immediately. Bank of America and most other financial institutions will not ask you to verify information in this way.
• Requests for security information claim that the bank has lost important security information and needs to update it online. Bank of America and most other financial institutions will not ask you to verify information in this way.
• Typos and other errors are often the mark of fraudulent emails or websites. Be on the lookout for: typographical or grammatical errors; awkward, stilted, or inappropriate writing; and poor visual or design quality.
• Too-good-to-be-true offers are often just that. Don't get mixed up in fraudulent activity by believing emails or web advertisements that offer to help you earn money by transferring cash.

See even more simple ways to protect yourself.

Protecting against email and website fraud

If you receive an email claiming to be from Bank of America that appears to be suspicious, do not reply or click on the link it provides - simply delete it.

To report a suspicious email that uses Bank of America's name, you can forward it to abuse@bankofamerica.com (If you have general questions about the bank or your accounts, please go to Contact Us.)

Bank of America |Privacy & Security | Preventing Fraud | Types of Online Fraud

PayPal - Protect Yourself from Fraudulent Emails

What is a fraudulent email?

A fraudulent (spoof) email pretends to be from a well-known company, such as PayPal or eBay, in an attempt to get personal information from you. People who send spoof emails hope to use your information - such as credit and debit card numbers or account passwords - to commit identity theft.

You can prevent spoof from affecting you

Spoof, or "phishing," emails - and the spoof websites often associated with them - are deceptive in appearance. However, they contain content that reveals they're fake. The most important thing to do to protect yourself is be able to spot this misleading content.

Know a spoof when you see it

Frequently, a spoof email looks something like this:
Spoof screenshot What to watch out for

1. Generic greetings. Many spoof emails begin with a general greeting, such as: "Dear PayPal member."

2. A false sense of urgency. Most spoof emails try to deceive you with the threat that your account is in jeopardy if you don't update it ASAP.

3. Fake links. The text in a link may attempt to look valid, then send you to a spoof address. Always check where a link is going before you click. Move your mouse over it and look at the URL in your browser or email status bar. If the link looks suspicious, don't click on it. And be aware that a fake link may even have the word "PayPal" in it.

Learn more ways to spot spoof

Read PayPal's 10 ways to recognize fake (spoof) emails now.

Questions PayPal will never ask you in an email

To help you better identify fake emails, we follow strict rules. We will never ask for the following personal information in emails:

* Credit and debit card numbers
* Bank account numbers
* Driver's License numbers
* Email addresses
* Passwords
* Your full name

Ways to fight spoof

• Report it. Forward the entire email - including the header information - or the site's URL to spoof@paypal.com We investigate every spoof reported. Please note that the automatic response you get from us may not address you by name.
  
• Use Account Guard on the eBay toolbar. If you use Internet Explorer, download the eBay toolbar. Account Guard helps ensure you are on PayPal or eBay. Download the eBay toolbar now
  
• Use the SafetyBar. Email security provider Cloudmark has engineered a toolbar for Microsoft Outlook you can use to report spoof emails. Should you receive a spoof, click the SafetyBar's "Block Fraud" button to automatically report it to us. Download the Cloudmark SafetyBar now

• We're dedicated to protecting you
  
• PayPal works hard to educate you on the best ways to recognize and fight spoof. Learn more about how PayPal fights fraud for you around the clock.
  
• Steps to take to prevent spoof from affecting you
  
• Keep your security software current. Update your firewalls and security patches frequently. Consider using software from companies like McAfee and Symantec.
  
• Monitor your account. Check your account periodically to see if there is any suspicious activity.
  
• Change your password often. And, if you think your security may have been breached, create a new password immediately.
  
• Use a unique password. Your PayPal password should be one-of-a-kind, and not used on any of your other accounts. A good password contains letters and numbers. This makes it more difficult for people to guess it.
  
• Take action. If your information is compromised, get a fraud alert placed on your credit report.

Get more information on how to prevent fraud. To download security tools, report fraud, and learn more about how we protect you, visit the PayPal Security Center today.

https://www.paypal.com/cgi-bin/websc...ySpoof-outside

Wells Fargo - Fake Emails and Web Sites

Online fraud occurs when someone poses as a legitimate company to obtain sensitive personal data and illegally conducts transactions on your existing accounts. Often called “phishing” or “spoofing,” the most current methods of online fraud are fake emails, Web sites and pop-up windows, or any combination of these.

Always keep in mind that Wells Fargo will never send email containing attachments, or require customers to send personal information to us via email or pop-up windows. Any unsolicited request for Wells Fargo account information you receive through emails, Web sites, or pop-up windows should be considered fraudulent and reported immediately.

Fraudulent emails
Never respond to emails, open attachments, or click on links from suspicious or unknown senders.

Fraudulent emails will often:

• Ask you for personal information. Fake emails often contain an overly generic greeting and may claim that your information has been compromised, that your account has been frozen, or ask you to confirm the authenticity of your transactions.
• Appear to be from a legitimate source. While some emails are easy to identify as fraudulent, others may appear to be from a legitimate address and trusted online source. However, you should not rely on the name or address in the "From" field, as this is easily altered.
• Contain fraudulent job offers. Some fake emails appear to be from companies offering jobs. These are often work-at-home accounting positions which are actually schemes that victimize both the job applicant and other customers. Be sure to confirm that the job offer is from a known and trusted company. Learn More about job scams.
• Contain prizes or gift certificate offers. Some fake emails promise a prize or gift certificate in exchange for completing a survey or answering questions. In order to collect the alleged prize or gift certificate you may be directed to provide your personal information. Just like with job offers, be sure to confirm that prize or gift certificate is being issued from a known and trusted company.
• Link to counterfeit Web sites. Fake emails may direct you to counterfeit Web sites carefully designed to look real, but which actually collect personal information for illegal use.
• Link to real Web sites. In addition to links to counterfeit Web sites, some fake emails also include links to legitimate Web sites. The fraudsters do this in an attempt to make a fake email appear real.
• Contain fraudulent phone numbers. Fake emails often contain telephone numbers that are tied to the fraudsters. Never call a number featured on an email you suspect is fraudulent, and be sure to double-check any numbers you do call.
• Contain real phone numbers. Some of the telephone numbers listed in fake emails may be legitimate, connecting to actual companies. Just like with links, fraudsters include the real phone numbers in an effort to make the email appear to be legitimate.

View examples of recent fake emails.

Trojan horses
These fake emails may also contain a virus known as a “Trojan horse� that can record your keystrokes. The virus may live in an attachment or be accessed via a link in the email.

Again, Wells Fargo customers should keep in mind that we do not request personal information via email or send email attachments. Never respond to emails, open attachments, or click on links from suspicious or unknown senders.

If you are not sure if a Wells Fargo email is legitimate, report it to us without replying to the email.

How is my email address obtained?
Email addresses can be obtained from publicly available sources or through randomly generated lists. Therefore, if you receive a fake email that appears to be from Wells Fargo, this does not mean that your email address, name, or any other information has been taken from Wells Fargo information systems.

Fraudulent Websites
Online thieves often direct you to fraudulent Web sites via email and pop-up windows and try to collect your personal information. In many cases there is no easy way to determine that you are on a phony Web site because the URL will contain the name of the institution it is spoofing. However, if you type, or cut and paste, the URL into a new Web browser window and it does not take you to a legitimate Web site, or you get an error message, it was probably just a cover for a fake Web site.

Another way to detect a phony Web site is to consider how you arrived there. Generally, you were directed by a link in a fake email requesting your account information. Again, Wells Fargo will not request personal information from customers via email and any unsolicited request should be considered fraudulent and reported immediately.

How can I help protect myself?
With a few simple steps, you can help protect your Wells Fargo accounts and personal information from fake emails and Web sites:

• Delete suspicious emails without opening them. If you do open a suspicious email, do not open any attachments or click on any links it may contain.
• Never provide sensitive account or personal information in response to an email. If you have entered personal information, call Wells Fargo immediately at 1-866-867-5568.
• Install and regularly update virus protection software.
• Keep your computer operating system and Web browser current.

Review additional steps you can take to help protect yourself from fake emails, Web sites, and other fraudulent activity.

https://www.wellsfargo.com/wf/privac...on/fake_emails

Local scams revealed - Tips To Avoid Them

by Rosie Schluter
Friday September 22, 2006

Fighting scams locally was the topic of last week's public meeting of the newly organized Triad -- a partnership of citizens and law enforcement.

Pat Thompson, Goodhue County Captain of Investigations and a 20 year veteran of law enforcement told how an area person was recently bilked out of $1250. The plot was accomplished by a phone call informing her that she had won $1 million but first she had to send a money order of $250 to redeem it. She actually did this five times. The money was sent to Canada and that is out of local law enforcement's jurisdiction. They tracked the phone number calling her to a prepaid cell phone. But with tactics like these, criminals have a likely chance of not being apprehended. And the money is usually lost.

Police officers also may find themselves involved in a scam. Thompson got a call that there was unusual activity on his bank account. Huge amounts of charges actually. Thompson kidded that he checked with his wife and then decided it was not any of their purchases. But somehow the criminals had gotten his account number. But it was cleared up.

Thompson suggests that if someone calls you for bank information you should ask for your last check number cashed, or perhaps the last five deposits, etc. to make sure you are talking to a reputable person of your bank.

Also, he recommends that you be a "fine print reader." This information would have helped another local citizen who found out the hard way. She received a check for $2.50 in some of her mail. So she cashed it.

But then she found out she had inadvertently joined a buying club!

Another trusting soul who had been befriended by a person who later became identified as part of a scheme to take $100,000 from her by mortgaging her home and even more from cashing in her securities was explained by Bob Rohl from the Kenyon area.

In Bob's case, the victim was a family member. He explained, she was vulnerable because she was a caring person who wanted to help people. She was also going through "trying, emotional times" when her husband was dying.

She met a concerned man who could show her information that he had been a profitable businessman but was now down on his luck. To help him, she provided a place for him to live and bought him a car.

But he got caught when he brought her to a bank to try to get cash for some securities she had just sold. Several banks wouldn't do it.

Then he tried to open an account for her to deposit the money and then presumably withdraw it. But a bank employee became suspicious and contacted the police who came and arrested him on the spot, Bob revealed. The FBI also became involved he explained.

Legal steps, such as what Rohl went through, were touched on by assistant Goodhue County attorney, Stephen O'Keefe. His office helps obtain search warrants and administrative subpoenas to get phone records, etc. Identifying the real scam artist might be difficult. Scams are disguised as legitimate businesses. The result may be that even if they are prosecuted and convicted, the money is still gone. O'Keefe's message was: "Prevention is the key."

This led to Cannon Falls' Interim Police Chief, Rich Wisniewski giving tips to avoid scams.

1. One of the best, he chuckled, was to talk over an investment with your family -- if it's like his! They don't have to be tactful!
   
2. Be wary of paying in advance. Pay only after the work is done or delivered.
   
3. Don't feel pressured into making a decision.
   
4. Never give your credit card number over the telephone unless you make the call.
   
5. Keep a list of telephone numbers to call to report the loss or theft of your wallet, credit cards, etc.
   
6. Report unauthorized financial transactions to your bank, credit card company, and the police as soon as you detect them.
   
7. Legitimate businesses understand that you want more information about their company and are happy to comply. Also, obtain a salesperson's name, business identity, telephone number, street address, mailing address and business license number before you transact business.

Wisniewski concluded that you need to be vigilant. Put your name on the national "do not call" list. Keep your credit card numbers on file. Review your credit card statements. And e-mail is good because it records the date and time. Keep a hard copy.

The local Triad meets monthly at the Shepherd's Center in Cannon Falls and is open to the public. Next discussion on local issues is Wednesday, October 11 at 1 p.m Next informational meeting is in November on "Identity Theft."

Source: CannonFalls

Victims Stuck with $80,000 Scam Loss.

December 01, Honolulu Advertiser
Two Windward Oahu, HI, residents who thought they had been hired by legitimate foreign companies to distribute checks were victims of a scheme that's left them responsible for $80,000. One victim is a Kaneohe businessman who negotiated a contract with a Japanese company. The other is the wife of a Kaneohe Bay Marine who filled out an online application with a Chinese corporation claiming to be a subsidiary of oil giant Sunoco Inc. Both believed they would be acting as "check distributors" for companies. After being "hired," they agreed to receive checks from these companies and keep a percentage while wiring large sums to accounts in China and Japan, police said. Unwittingly, both the man and woman were about to cash fraudulent checks 4 and wire the money back to the perpetrators.
The checks from the "foreign companies" initially cleared the local banks, and the residents were each able to wire $40,000 to accounts in Japan and China as instructed by their employers. But federal regulators discovered that the checks deposited by the residents were counterfeit, and the banks are holding the residents responsible for the funds. This is a new twist on the Nigerian letter fraud. Source: Error: Invalid story key (M1,20061201,NEWS06,612010362,AR). - The Honolulu Advertiser