The truth about internet fraud

Posted on 7 May 2009 at 14:53

• 
• 
• 
• 
• 
• 
• 

 1 of 7

Gallery

There's been a great deal reported on the subject of phishing. Pronounced the same way as 'fishing', this scam is designed to trick as many people as possible into sending criminals their details.

There are two stages to a typical phishing attack. First, you'll be asked to log on to a website. The attackers will use a number of ruses to tempt you to do this. When you click on the link, you'll see what appears to be a genuine website, possibly belonging to your bank, auction service or a charity.

The second part of the attack occurs when you enter your username and password into the site. Because it's a fake site run by criminals, it won't log you into the service that you expect. Instead, it will store your username and password. If the site is pretending to be a bank, the hackers not only know that you use this particular bank, but they also have your login details. Some fake sites may try to log you into the real service after they have stolen your details, so you will be none the wiser.

Once the criminals have your details, they may use them to try to access your web-based account directly or add your information to a file that is then sold to other criminals.

Spotting phishing attacks

Invitations to a fake site can appear in many guises. Spam emails often contain links to phishing sites; messages on social-networking sites may include harmful links; fake charity websites will steal your money more directly than we've described above; and you can even receive phishing links when you use instant messaging, or as a text message on your mobile.

Usually you will find phishing links in spam emails. These can be targeted, being sent only to people who are known to use a particular bank, or sent out randomly. An example arrived in our special email account (which is designed to catch viruses) even though we don't have a NatWest bank account.

If you click on a phishing link, your browser will load a site that looks like a legitimate web page. After you enter your details, the site will probably claim that you have been successful in registering with the new system. In a few seconds the official bank web page will be loaded automatically. You will then discover that you're not logged in and will have to repeat the process on the real site. You'll probably only discover you've been the victim of a scam when money disappears from your account.

Advance fee fraud

This is an old hoax, designed to con people out of their cash, which has been doing the rounds for years. Even before the internet existed, this type of fraud was rife. It was usually spread using regular letters and fax machines. It's cheaper and easier to send to millions of emails to people, so the criminals have adopted the new technology.

The scam involves tricking victims into paying money in the hope of reaping greater rewards later. This is known by many names, including money transfer fraud, advance fee fraud or 419 scam. The name 419 comes from the article of the Nigerian Criminal Code, which refers to fraud. The 419 scam originated in Nigeria in the 1980s, although similar cons had been occurring in many other countries long before then.

Although there are hundreds of different versions of the 419 scam, there's one simple theme to all the variations. The con artist asks for the victim's help in moving an astronomically large amount of money from an account in secret. In return, the victim is promised a large chunk of the proceeds.