First off I should explain what phishing is. Phishing is basically the act of tricking a victim into divulging information. It involves the receiving of an email message with a link to a website where the victim would enter personal information. In this particular scam, you get an email from "Personal Banking: personalbanking@wellsfargo.com" stating that there may have been some unauthorized access to your account and that you should click the link and enter your account and verify some information. When you click the link you are taken to a site which looks identical to the Wells Fargo site.
If you look at the HTML code of the site, you'll notice that they are almost identical. One thing about this scam which was somewhat surprising is that the message made it past my G-mail spam filter. This is slightly different to scams I have seen before in that they don't ask you to reply to this email with your account number like most others, and they don't ask for passwords or anything like that. They simply request that you log in, as you normally do, which would not raise the eyebrow of normal users. On a closer inspection of the site you will notice that the forms submit the data entered (user name and password) to some foreign script and not to Well Fargo. Most probably, the scammer is having all the usernames and passwords emailed to him. After submission of your information the site responds that your password is incorrect. Here an unsuspecting victim would assume that this was because of the supposed unauthorized access mentioned in the email.
If you try to submit information a few more times, it takes you to another Wells Fargo look-alike page called "Online Banking Verification". Here they ask for SSN number, your ATM card number, the expiration date, the pin number and the CVV2# (4 digit verification). With the ATM information the scammer could max out your debit card. With all the rest of the information he has gathered it would not be at all difficult to call up Wells Fargo and basically take over your account. He could change billing addresses, get checks for you account, and simply wipe it out.
How to spot scams like this
Scams like these are usually easy to spot, but this one in particular was a bit tricky, however there are some basic methods you can use to spot these types of scams.
First of all, check the link. Although it looks like the link is going to Wells Fargo's website, if you let the mouse hover over the link for a while and look in the status bar, you will get the real address of the link. In this case the scammer used just an IP address of his domain or machine. This, however, can be overridden on the internet (if the scammer changes the status bar) and sometimes even in your email, depending on what your security settings are.
Check the address bar. In this case, the address bar reported that the website was also from the scammer's IP address. Simply put, it did not say www.wellsfargo.com. Very seldom would a scammer be able to fake this. They may, however, employ other tricks like buying a domain name with a slight spelling difference that the user might not notice or by simply loading the link in a new window and hiding the address bar altogether.
Lastly, the only full proof method to avoid becoming a victim to a scam like this is to simply call in and verify the information over the phone. Please note; do not use a phone number in the email if one is given. Open up your phone book and locate the number for your firm and ask them about it.
Just remember, if it looks funny and feels funny, it's probably a scam. Do not ever reply to such email messages for personal information as sensitive as account information and SSN.
Below is a copy of the email message for your review and amusement. The link is active, however DO NOT ENTER ANY PERSONAL INFORMATION INTO THESE FORMS. THIS IS NOT WELLSFARO'S SITE.
Kevin. A. Lloyd.
From: Personal Banking < personalbanking@wellsfargo.com >
To: me@me.com
Date: Jun 2, 2005 2:22 PM
Subject: Security Notice #291240 Wells Fargo Internet Banking account
Update Necesary!
Dear Member,
We recently reviewed your account, and suspect that your Wells Fargo Internet Banking account may have been accessed by an unauthorized third party. Protecting the security of your acount and of the Wells Fargo network is our primary concern. Therefore, as a preventative measure, we have temporarily limited access to sensitive account features. To restore your account access, please take the following steps to ensure that your account has not been compromised:
1. Login to your Wells Fargo Internet Banking account. In case you are not enrolled for Internet Banking, you will have to use your Social Security Number as both your Personal ID and Password and fill in all the required information, including your name and account number. 2. Review your recent account history for any unauthorized withdrawls or deposits, and check your account profile to make sure not changes have been made. If any unauthorized activity has taken p! la ce on your account, report this to Wells Fargo staff immediately.
To get started, please click on the link below:
https://online.wellsfargo.com/signon?LOB=CONS
We apologize for any inconvenience this may cause, and appreciate your assistance in helping us maintain the integrity of the entire Wells Fargo system. Thank you for your prompt attention to this matter.
Sincerly,
The Wells Fargo Team
Kevin A. Lloyd:
Just launched a website, http://www.DeleteMySpam.com/, dedicated to helping to eliminate the spam crisis.
It seems that nowadays cybercriminals prefer cash to fun. That... Read More
Spyware protection software is the easiest way of removing spyware... Read More
Shopping for horse gifts or other gift items on the... Read More
I am in the midst of Oscar Wilde's The Picture... Read More
Every now and then you can read about a new... Read More
Ebay is a great site and is used by many... Read More
A week or so ago, I received an inquiry from... Read More
What is a Firewall?The term "firewall" illustrates a system that... Read More
The Loss Prevention Manager should be receptive to the needs... Read More
Identity theft rates one of the fastest growing crimes in... Read More
Chris Simpson, head of Scotland Yard's computer crime unit was... Read More
A friend called me one day and asked if I... Read More
There you are busily typing away on your PC or... Read More
No auntie Sookie, not earth worms, computer virus worms that... Read More
It's a sad statistic, but hundreds of unsuspecting kids are... Read More
The first thing people think about when defending their computers... Read More
At this point, if you've got the whole "turning the... Read More
A few nights ago I received an email from "2CO"... Read More
Someone recently told me, "You would have to be a... Read More
What is computer security? Computer security is the process of... Read More
Today,on most internet user's computers, we have the ability to... Read More
If you are a parent, as am I, I think... Read More
Internet scams and frauds are on the rise! The quantity... Read More
When it comes to a secure website and passwords it... Read More
Paypal is a great site and is used by many... Read More
Scams involving email continue to plague consumers across America, indeed... Read More
No longer are viruses the only threat on the internet.... Read More
Your computer is as slow as molasses. Your mouse freezes... Read More
This is the second in a series of articles highlighting... Read More
Millions of people make purchases online, but many people are... Read More
What is Phishing? Phishing is a relatively newly coined term... Read More
Beware of a New Scam Aimed at Bargain-HuntersTrying to buy... Read More
If you know what is the 'Fishing' then it's very... Read More
The E-Mail Identity Theft Scam is running Rampant. These E-Mail... Read More
I am in the midst of Oscar Wilde's The Picture... Read More
Over the past few years as the internet has become... Read More
Having a good Spyware eliminator on your computer is vital... Read More
Identity theft is one of the most common criminal acts... Read More
WHAT IS HACKING?Hacking, sometimes known as "computer crime" has only... Read More
Manual Spy Bot Removal > BookedSpaceBookedSpace is an Internet Explorer... Read More
I got a virus the other day, Thursday I believe... Read More
Long gone are the days that we could feel secure... Read More
For many, the daily walk to the mailbox evokes mixed... Read More
We all know that it's dangerous to use the same... Read More
On December 8, 2004 Webroot, an award winning anti-spyware solution... Read More
A couple of years back, I paid my dues the... Read More
Every single time you access a website, you leave tracks.... Read More
Much has been said on the theory of password protection... Read More
Credit card fraud is a growing problem for online businesses... Read More
Viruses, Trojans and Spyware: Protecting yourself.No user on the internet... Read More
Identity theft rates one of the fastest growing crimes in... Read More
There are ways to insure security though. You can get... Read More
They're out there. Individuals trying to make a quick buck... Read More
We all get the odd virus now and then, but... Read More
During the release of a new software product specialized to... Read More
Today's Internet or World Wide Web is being over regulated.But,... Read More
The words Corporate Security may conjure up images of a... Read More
First the basic definition of Spyware: It is a type... Read More
What is Phishing? Phishing is a relatively newly coined term... Read More
Geek SuperheroGeek Superhero watches your computer for changes, immediately notifying... Read More
Security leaks can be a big problem for any site... Read More
Do you sometimes notice your computer running slower. Is your... Read More
Before we start, I want to make it clear that... Read More
Nobody wants to pay to remove spyware. At the very... Read More
Before you enter your name, address or any other data... Read More
Ok, ok, I know you've seen them. All those pop... Read More
Internet Security |