Phishing Scams

Phishing occurs when an individual or group falsely poses as a legitimate organization, such as a bank or credit card company, in order to trick a victim into submitting personal information online. This is usually done by instructing the user to click on a link that leads to a fake website designed to look legitimate. In other cases, criminals pose as charities soliciting donations to aid humanitarian efforts.

Then there is “spear phishing,” a tactic in which messages appear to be from actual co-workers, friends or family members. Instead, these messages are from hackers who were able to access an individual's email account and subsequently use that individual's address to send phishing emails to all of the individual's contacts.

To avoid falling prey to the wide variety of phishing scams, please follow these guidelines:

• Never click on embedded links in unsolicited emails.
• Never give personal information, passwords or financial information by email. The FBI and the IRS will never use email to contact customers if there is a problem. Legitimate contacts from these sources will always come via first class U.S. Postal Service mail. In addition, most banks will not conduct confidential business via email, even if a customer has an online banking account.
• It is better to err on the side of caution by deleting any email that requests sensitive information, even if the sender appears to be familiar or from within your own parish or organization.
• Remember that information shared by email is never completely private.

The U.S. Computer Emergency Readiness Team website offers more information on how to avoid and respond to phishing scams: http://www.us-cert.gov/

In addition, please read Gallagher's security document: Gone Phishing - Cyber Risk Management.