Fraudulent E-mail Thieves Intend to Steal Your Personal Information

CONSUMER ALERT

BILL SCHUETTE
ATTORNEY GENERAL

The Attorney General provides Consumer Alerts to inform the public of unfair, misleading, or deceptive business practices, and to provide information and guidance on other issues of concern.  Consumer Alerts are not legal advice, legal authority, or a binding legal opinion from the Department of Attorney General.

FRAUDULENT E-MAIL
THIEVES INTEND TO STEAL YOUR PERSONAL INFORMATION 

HOW THE SCAM WORKS

Crooks are continuing to unleash fraudulent e-mail scams at a ferocious pace.  Many of these are designed to trick consumers into parting with their valuable personal or financial information.  For information on current e-mail scams, the Attorney General recommends visiting websites that track phishing frauds and provide informational updates for consumers, such as www.antiphishing.org. 

This type of scam, often referred to as "phishing" or "carding," begins with e-mails that are carefully constructed to look like legitimate messages from familiar businesses or government offices.  The crooks lurking behind these messages often weave plausible stories related to customer-service or security needs, which direct consumers to click on hyperlinks contained in the messages to clear up the purported problem.  But the links lead the unsuspecting victims to phony imitations of legitimate websites, often hosted by a Web servers in foreign countries, where victims are induced to relinquish valuable personal information in order to "verify" or "confirm" their account information.  In an effort to distract consumers, scammers often conclude the interaction by redirecting unwitting site visitors to a legitimate website.  

And so begins a series of fraudulent transactions perpetrated by identity thieves in the victim's name. 

One prevalent type of phishing scam starts with a fraudulent e-mail from popular online merchants, such as eBay or PayPal.  The e-mail looks almost exactly like a typical order confirmation message, which businesses commonly send to consumers who recently made a purchase online.  Scammers often put an order number in the subject line of the e-mail in order to lure consumers into opening the message.  Not only is responding to the e-mail dangerous, but even the mere act of opening the message can unleash a dangerous virus or "spyware" onto your computer. 

DO NOT PROVIDE PERSONAL INFORMATION TO SOMEONE WHO CALLS OR E-MAILS YOU

Regardless of whom they claim to be, people who call or e-mail you seeking personal or financial information should be treated as potential thieves who may be trying to steal your identity.  Resist their alarming or believable scenarios and urge to update, validate, or confirm sensitive information.  Do NOT provide people who call or e-mail you with any personal information.  Remember, identity thieves are crafty, and they may be attempting to contact you numerous times using a different alias for each e-mail.  

PROTECT YOURSELF

• Be cautious about opening any attachment or downloading any file from e-mails you receive, regardless who sent them.  These files can contain viruses or other software that can weaken your computer's security.
• If you get an e-mail or pop-up message that asks for personal or financial information, do not reply.  And don't click on the link in the message, either. Legitimate companies don't ask for this information via e-mail.
• If you receive an e-mail from a familiar online merchant, make sure that before opening, you compare the order number in the subject line of the e-mail to the receipt you printed from the merchant's website when you completed your order.  Also, look for a digital signature. If the order number in the subject line does not match the order number on your receipt, do not open the e-mail!  Delete it immediately. 
• If you are concerned about unauthorized activity in your account, contact the organization mentioned in the e-mail using a telephone number you know to be genuine, or open a new Internet browser session and type in the company's correct Web address yourself.  In any case, don't cut and paste the link from the message into your Internet browser - phishers can make links look like they lead to a familiar Web page when in reality they point to a fraudulent look-alike site.
• Install protective anti-virus, anti-spyware, and firewall software, and keep them up-to-date.  Some phishing e-mails contain software that can harm your computer or track your activities on the Internet without your knowledge.  Anti-virus software and a firewall can protect you from inadvertently accepting such unwanted files.  Anti-virus software scans incoming communications for troublesome files.  Look for anti-virus software that recognizes current viruses as well as older ones, that can effectively reverse the damage, and that updates automatically.
  
  A firewall helps make you invisible on the Internet and blocks all communications from unauthorized sources. It's especially important to run a firewall if you have a broadband connection.  Operating systems or browsers also may offer free software "patches" to close holes in the system that hackers or phishers could exploit.
• Check your browser (Firefox, Internet Explorer, Chrome, Opera, Safari, etc) to see if it has anti-phishing features, such as a toolbar that compares websites you attempt to visit with known phishing sites. 
• Don't e-mail personal or financial information.  E-mail is not a secure method of transmitting personal information.  If you initiate a transaction and want to provide your personal or financial information through an organization's website, look for indicators that the site is secure, like a lock icon on the browser's status bar or a URL for a website that begins "httpS://" (the "s" stands for "secure").  Unfortunately, no indicator is foolproof; some phishers have forged ("spoofed") security icons and "https" sites.  

• Forward (don't open and copy!) the entire email you believe may be a phishing scam to the Federal Trade Commission at spam@uce.gov.  Also forward the email to the company, bank, or organization impersonated in the phishing e-mail.  Most large companies have information on their legitimate websites about phishing scams and a special email address for reporting problems. 
• Review credit card and bank account statements as soon as you receive them to check for unauthorized charges.  If your statement is late by more than a couple of days, call your credit card company or bank to confirm your billing address and account balances.
   

FOR VICTIMS

Victims of phishing may become victims of identity theft.  Tips for minimizing your risk and other information related to ID theft are outlined in the Attorney General's Consumer Alert, "Identity Theft Information for Michigan Consumers" (available at: http://www.michigan.gov/ag/0,4534,7-164-17337_20942-230557--,00.html. 

If you believe you've been scammed out of money in a phishing scheme, visit the FTC's Identity Theft website at http://www.ftc.gov/bcp/edu/microsites/idtheft and file a complaint with the FTC (visit https://www.ftccomplaintassistant.gov/ to get started).

If an identity thief opens credit accounts in your name, these new accounts may appear on your credit report.  You may catch an incident early if you order a free copy of your credit report periodically from any of the three major credit bureaus.  Read the Attorney General's Consumer Alert, "Free Annual Credit Reports-What Consumers Should Know" (available at http://www.michigan.gov/ag/0,1607,7-164-34739_20942-111010--,00.html) or visit www.annualcreditreport.com for details on ordering your free annual credit reports. 
 

FILE A COMPLAINT

If you encounter a company that insists you are responsible for a debt incurred without your authorization as a result of identity theft, you may contact the Attorney General's Consumer Protection Division at:
 

Consumer Protection Division
P.O. Box 30213
Lansing, MI 48909
517-373-1140
Fax: 517-241-3771
Toll free 877-765-8388
www.michigan.gov/ag  (online complaint form available)