EmailEmail
PrintPrint
Post Your Problems
BBB target of e-mail 'phishing' scheme
Thursday, November 13, 2008
Mollie E. Murray, membership director for the Monroeville Better Business Bureau, grimaces as she lifts a heavy box of papers from the trunk of a car. The event was part of the national "Secure your ID Day."

Phishing.

Crooks do it to hook unsuspecting consumers.

To avoid getting caught, hit the delete key on your computer.

Again, again and again.

That's the advice of the Better Business Bureau.

The bureau, which recently sponsored a "Secure Your ID" Day to help consumers protect their identity, now finds itself the target of a phishing scheme designed to mislead its members and the public.

In an e-mail alert to its member businesses and consumers, the bureau said the scheme uses e-mail messages and blog posts directing recipients and viewers to register software with the BBB.

The bureau said it wants the public to know that such messages and posts "are not coming from any element of the BBB system, and that this attack has not affected BBB computer systems or networks nor has any data been compromised."

Warren King, president of the local BBB based in Green Tree, said the e-mail and blog postings "are most likely part of a large-scale phishing scam leveraging the trusted nature of the BBB name to entice recipients and bloggers to open messages and access attachments or links.

"Anyone receiving an e-mail or viewing a blog requiring the registration of software with the BBB should not click on any links or in any way respond to the message," Mr. King said. "Doing so may allow harmful viruses or spyware to enter the recipient's computer or network."

Phishing is a criminal mechanism employing "social engineering and technical subterfuge to steal consumers' personal identity data and financial account credentials," said the Anti-Phishing Working Group (www.antiphishing.org).

"Social engineering schemes use spoofed e-mails purporting to be from legitimate businesses and agencies to lead consumers to counterfeit Web sites designed to trick recipients into divulging financial data such as user names and passwords," the group said.

"Technical subterfuge schemes plant crimeware into personal computers to steal credentials directly, often using systems to intercept consumers online account user names and passwords -- and to corrupt local navigational infrastructures to misdirect consumers to counterfeit Web sites."

Mr. King said opening or viewing a preview of the e-mail or clicking on a link within an e-mail "could enable a discreet download of a virus or spyware." He said the BBB has been working with the U.S. Secret Service's Electronic Crimes Task Force to deal with phishing issues that involve the bureau.

The BBB has set up an e-mail address -- phishing@council.bbb.org -- that the public can use to forward phishing e-mails to the bureau and the task force. Mr. King said the public can see updates and the latest information on phishing attacks on the bureau's Web site at www.bbb.org/securityalerts.

Because identity theft is so rampant, the bureau hosted a free document-shredding event on Sept. 20 in Monroeville for residents and small businesses in that town and nearby communities.

It was a big success. Almost 12,000 pounds of documents were sliced to pieces by a mobile shredder donated by The Paper Exchange in the parking lot of Roth Carpet & Floors at 3845 Northern Pike. BBB volunteers unloaded hundreds of boxes and bags of documents from the back seats and trunks of the 271 vehicles that came to the site.

The event, part of a national BBB-sponsored "Secure Your ID" Day, was supported by Equifax, the National Association for Information Destruction and ProQuo.

Last year, 8.1 million Americans became victims of ID theft, resulting in a loss of $45 billion, according to a 2008 report from Javelin Strategy and Research.

The report said 56 percent of ID thefts occur when the thief has direct contact with the victim's personal information through a lost or stolen wallet, by rifling through a personal mailbox or trash can, or even lifting documents from inside a home or business.

"This is largely a crime of access," Mr. King said. "Our goal is to make the information less accessible and empower people to be their own first line of defense against identity theft. And one of the ways they can do it is by buying their own shredding machine."

He said the bureau will host another shredding event on April 18, but hasn't decided where it will be.

For more information, go to www.pittsburgh.bbb.org or call 412-456-2700.

Lawrence Walsh can be reached at pyp@post-gazette.com and 412-263-1488. More articles by this author
First published on November 13, 2008 at 12:00 am
Post Your Problems