Don't get caught by phishing schemes!

by Linda Gonse
Editor, Orange County IBM PC Users' Group, California
From the December, 2005 issue of the I/O Port Newsletter

In one week, I received three emails appearing to be from well-known companies. But, knowing that phishing scams concentrate on disguising themselves as ISPs, retail, or financial companies, I resisted clicking on any of the links which could lead to a bogus website and possible infection by a keylogger program. Instead, I suspiciously read the text in one authentic-looking email from "PayPal," and studied the full header on the message (see header below). Email header from spoofed "PayPal" message 
Received: from main2.ezpublishing.com ([72.19.192.71])
          by rwcrmxc11.comcast.net (rwcrmxc11) with ESMTP
          id <20051024211706r1100p6kqre>; Mon, 24 Oct 2005 21:17:06 +0000
X-Originating-IP: [72.19.192.71]
Received: from main2.ezpublishing.com (localhost [127.0.0.1])
	by main2.ezpublishing.com (8.13.1/8.13.1) with ESMTP id j9OLGWBG020266
	for  ; Mon, 24 Oct 2005 14:16:32 -0700
Received: (from root@localhost)
	by main2.ezpublishing.com (8.13.1/8.13.1/Submit) id j9OLGWWB020263
	for ; Mon, 24 Oct 2005 14:16:32 -0700
Received: from jamaicans.tv.propagation.net (jamaicans.tv.propagation.net [64.182.1.110])
	by main2.ezpublishing.com (8.13.1/8.13.1) with ESMTP id j9OLGVlZ020257
	for ; Mon, 24 Oct 2005 14:16:32 -0700
Received: (from nobody@localhost)
	by jamaicans.tv.propagation.net (8.11.6p2/8.11.6) id j9OLH7v15310;
	Mon, 24 Oct 2005 16:17:07 -0500
Date: Mon, 24 Oct 2005 16:17:07 -0500
Message-Id: <200510242117.j9OLH7v15310@jamaicans.tv.propagation.net>
To: editor@orcopug.org
Subject: Paypal Security Measures
From: 
Reply-To: 
MIME-Version: 1.0
Content-Type: text/html
Looking at the header is easy to do in Outlook Express. Just right click on the unopened email file. Then, left click on Properties. Left click on the Details tab, and click on the button Message Source. (At other times, this also allows me to peek inside an email without officially opening it and letting a virus or worm loose on my system.) Next, I went to PayPal's site and took a look at their answers about phishing scams. By then, I was sure that the emails I'd received were fake and intended to "phish" out my personal information. All the targeted companies provided email addresses to report fake emails to follow up on them, so I forwarded those I'd received and deleted them from my email program. The top 10 companies targeted as phishing bait are: Citibank, eBay, US Bank, PayPal, Fleet Bank, Lloyds TSB, Barclays, Earthlink/AOL, Halifax, and Westpac. According to The Washington Post, "EarthLink gets around 300 phone calls and spends just under $5,000 per incident. Still, the nation's fourth-largest ISP encounters about 15 new phishing scams a month featuring email that purports to come from its own service. "Phishers now focus almost exclusively on banks and online shopping sites. During the past 10 months, nearly 60 percent of their attacks targeted Citibank or US Bank, according to the Anti-Phishing Working Group, http://www.antiphishing.org/. Earth-Link and America Online are the targets for about 3 percent of the scams." How can I tell the difference between a real PayPal email and a fake one?