Phishing moves to Pharming

Be alert for online fraud

Online identity theft is the fastest growing crime in the country. In 2003, ID theft cost consumers, businesses and government organizations over $200 billion in losses. By the end of 2005, those losses could reach $2 trillion. Besides mailbox tampering, phishing, and credit card theft, pharming is becoming a big concern.

Pharming is the next generation of phishing; a more sophisticated way for thieves to fraudulently obtain personal financial information while you’re online. Where phishing works on one person at a time, pharming grabs large groups of victims at once. Pharming uses DNS address poisoning, which tricks your computer about where the data is coming from. DNS addresses are text-strings—like towerfcu.org. Your browser translates text-strings into an IP address—like 212.345.678.900. Pharming corrupts this translation, and gives no indication on your computer that anything is wrong. You think you’re on your credit union’s website, but the attack redirects all of your activity—online banking, passwords—to the thief’s computer.

How do I know if I’m being pharmed?

Secure sites have what are called Secure SSL Certificates; usually indicated by a lock at the bottom of your screen. Pharmers sometimes use certificates that don’t match the name of the site you’re attempting to access. Be alert for warnings on your computer like “the name on the security certificate is invalid or does not match the name of the site.”

How do I protect myself?

A knowledgeable computer company can assist you with getting anti-malware software and a personal firewall. Other anti-pharming software is currently being developed to work against hackers.

Be alert online

• A legitimate financial institution will not send you an e-mail asking for account or credit card information. Delete any questionable e-mail, and do not click on the links provided.
• Most phishing scams are fairly obvious, containing glaring grammatical and spelling errors, offers of millions of dollars, or unfounded threats to your credit record.
• Check your credit card and banking statements each month for unauthorized or suspicious charges.
• Report suspect e-mail to: antiphishing.org, or to the Internet Fraud Complaint Center at www.ic3.gov/about/. To file a complaint with the FTC, go to ftc.gov, or call 877-FTC-HELP.

Preventing ID theft is a team effort between your credit union and you. For more tips on prevention and reporting ID theft, visit towerfcu.org for the “Identity Theft—Don’t Let It Happen to You” brochure.