[ news_security_news ]
Surprise: New EBay Spear Phishing Scam
John Stith
Staff Writer
2006-01-04
 Insider Reports RSS Feed
One of the strengths of eBay is the openness with which people can do business. It's easy for people to set up their own business around eBay. It's essentially an open market and people pay their booth rental fee and that's it. The strength is also a weakness. The openness can lead to fraud problems and phishing scams seem to top them all. Now there's a new one.
Apparently the phishermen are sending out forged auction inquiries via email. Naturally, the email has a "Respond Now" link in it. And naturally people click on the links, plug in the asked for info and get hijacked. The spear phishing is a little trickier to deal with though. It's much more focus and goes after specific individuals or groups. They're designed to lull victims into security and then get speared.
"Just about anyone with an email account has undoubtedly seen an eBay
phishing scam email at one time or another," said Ted Green, CEO of
SpamStopsHere. "We are seeing an evolution in phishing and spear phishing
attacks. The sophistication of attacks is constantly increasing. Cyber
criminals are relentless in developing new and ingenious methods of monetary
and identity theft. End user education is the best defense against spear
phishing attacks."
SpamStopsHere lists a few tips to help prevent phishing scams from working:
1. If an email asks you to log into your bank, PayPal, eBay or other
personal account, assume it is a phishing scam.
DO NOT UNDER ANY CIRCUMSTANCE CLICK ON THE LINK IN THE EMAIL
2. Never enter banking information, social security numbers or other
sensitive information by clicking a link in an email.
3. Never enter your computer user name or password into an email that
requests it, not even if it claims to be from your IT manager or other co-
worker. It is easy for a spammer to forge the sender's name.
4. If you are unsure as to the legitimacy of a particular email, open an
Internet browser and manually type in the URL of the institution in question,
e.g. "www.chase.com". Do not use the URL in the email as a reference, as it
may be a forgery.
5. Treat any email that asks for sensitive data as a phishing scam.
About the Author:
John is a staff writer for SecurityProNews covering cyber security.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
