Phishing and identity theft
No, we haven't spelt it wrong. If you haven't heard of phishing, you'd better catch up quick. Here's how to avoid being tricked into giving out personal details online and having your identity stolen.
What is Phishing?
Phishing is an online scam where people try to trick you into giving them your personal or financial details.
How does it work?
Typically, you receive an email that looks like it's from an online organisation you may have given your details to: it might look like something from your bank, eBay or PayPal. The email says you need to reconfirm your details and asks you to follow a link to their site to do so. This link actually takes you to a spoofed website, which looks like the company's but is run from a server that the scammers have access to.
If you input your details there, they will go straight to the scammers, who can then use them to empty your bank account, obtain a passport or do any number of criminal activities in your name.
How can I protect myself?
- Treat any email asking for your credit card number, bank details, passwords or anything else important as highly suspicious.
- Don't click on a link in an email - it may not go to the address it says. Instead, type it directly into your browser so you know where you are going. If you get something claiming to be from Paypal and asking you to update details, switch to your browser, type in www.paypal.com and log in manually. You'll soon see if the email was a scam or not.
- If you are in any doubt, contact the company concerned to verify the request for your details.
- Only ever put personal details into a secure website: one that has https:// at the beginning of the address, rather than just http://
Is there any online defence?
There are a few programs available online that help you verify that a site you visit is genuine. For example, Earthlink Scamblocker and SpoofStick, both available free, work by alerting you if you are entering a known fraudulent website. They also break down the URLs of the sites you visit, so you are able to see whether you are at the genuine website or just a spoofed copy.
Should I steer clear of putting any details online?
Obviously, that is the safest option. If you find you can't avoid it, then you can minimise the risks:
- As far as possible, always use a credit card. Credit card companies insure all payments over £100, so if someone else does start flashing your plastic around, you should be able to recoup the losses;
- Keep an eye on your finances, especially your bank and credit card statements. Often that is the first place you will notice if someone has stolen your details.
What should I do if I have my financial details stolen?
If you find your credit or debit card number, or your bank details have been stolen, contact the issuer as soon as possible to cancel the card or freeze the account. Most companies have a special 24-hour phone line for this purpose and it's worth finding the number when you join and keeping it on hand so can call it quickly when you need to. If you think charges on your statement look suspect, send a letter to the issuer, querying each charge.
What should I do if my eBay account is hijacked?
ebay has a devoted area on its site for reporting this kind of problem. There is also a hotline to call to report any online fraud.
What shall I do if my identity is stolen?
If a more complex problem arises, like your personal details being used to take out a passport or other document, contact the issuing body immediately. For instance, passport fraud should be reported to the Passport Service and driver's licence fraud should be reported to the DVLA.
