Go Phish!

I have been getting a rash of Phishing emails the last couple of days. Phishing is when a spammer sends an email that looks like its from a legitimate company, say Bank of America or Western Union. "Something terrible is going on with your account! Click here to fix it." The idea is that one of the random thousands – or millions – who get the email will actually click on the link. The page they are sent to looks official and asks for identifying information, which the person will likely enter, and suddenly that person's identity belongs to the internet.

I have received five emails and counting. They are all appear to be from a mail account like notifications@ or operator@ or security@ christopherguilmet.com, informing me that . . . well, let them tell you:

Dear user of the christopherguilmet.com mailing service!

We are informing you that because of the security upgrade of the mailing service your mailbox (christopher@christopherguilmet.com) settings were changed. In order to apply the new set of settings click on the following link: *link removed*


Best regards, christopherguilmet.com Technical Support.

Message ID#824ZRS796VGH3DDL573563HT3M93

What are some of the subtle clues that lead me to believe this is phishing? well, for starters, 1) technical support at christopherguilmet.com is ME. 2) There's also the awkward grammar. 3) They do not call me by name but say "user of the chris...guilmet.com mailing service." The exclamation point makes it seem so friendly! 4) The link they ask me to follow was different from what appeared. 5) They posted a long, technical looking link, but in fact the link goes somewhere just different enough that someone might not notice (I know this because I option-clicked the link, selected "Copy Link" from the menu that appeared, and pasted it into a text document to look at it. You could also hover over it if you are using Mac Mail, and the actual link will appear after a few seconds).

Phishing emails are very common. This particular one is probably automated. They almost certainly don't know that the website they're phishing is not a service provider, and has a client base of exactly one. But it does illustrate how canny, and dangerous, phishing is.

To protect yourself from being phished, NEVER follow the link in an email claiming to be from your bank, service provider, or anyone else, unless you are expecting it. NEVER reply to the email, or click on an unsubscribe link. When you do, you are letting the spammer know that it is a valid address with a human being on the other end (and really, they are not going to unsubscribe you from anything).

Look at the email: if your name or your user name does not appear in the email it is probably spam. When in doubt, contact the customer service department of the institution and find out if it is from them. Most large corporations, especially ones that deal with your sensitive information, have a fraud department. Forward the email to them.

Always view your email with a tiny bit of suspicion. That's the best way to stay protected, and to keep your valuable personal information out of the hands of spammers.