Tips to Safeguard Yourself from Fraudulent Email / Phishing Attempts

1) Identifying phishing/fraudulent attempts:

1. Legitimate online businesses will never ask you for sensitive personal information such as passwords, bank account or credit card numbers, PIN numbers, or Social Security numbers via e-mail. So, if you were asked to reveal this information online, this may be a fraudulent attempt.

2. Phishers normally use convincing messages to ask users to go to their websites and enter personal/sensitive information on the phishing website. It would be advisable to scan the types of messages contained in the email prior to visiting the websites.

   Among messages to be cautious of are as follows:

   • Security or server updates, maintenance upgrades, online banking problems

   • Billing information requests or billing issues

   • Official or urgent notices

   • Account updates, e-mail or account verification requests

   • Consumer alerts, customer warnings

   • Your account has been, or may be, suspended or needs to be reactivated

   • Problems with your account, errors found

   • Suspicious transactions, fraud investigation, unusual activity

   • Someone sent you money, payment acknowledgments, order confirmations, lottery wins, jackpot wins, competition wins

   • Requests for assistance with fund transfers (the infamous 'Nigerian' scam)

   • Offers of advice on how to protect yourself from fraudulent transactions, identity theft solutions

3. The phishing email does not address a user by his/her name.

4. No confirmation of the company that does business with you, such as referencing a partial account number.

5. The email warns that your account will be shut down unless you reconfirm your financial information.

6. Spelling or grammatical errors in the phishing emails.

2) Avoiding phishing attempts

1. Do not respond to e-mails requesting for your personal information. Legitimate companies do not ask their customers for confidential information, such as passwords and account numbers, though e -mail.

2. Do not open attachments or download files. Phishers can use these files to infect your computer with a virus or spyware.

3. Do not click on links provided in e-mails. If you are uncertain about a website address that appears in an e-mail, go to your browser and enter the legitimate address manually. Phishers can use links to point recipients to a "spoofed" site, using an address similar to a real bank's URL. If in doubt, phone the business in question. Use a phone number that you have obtained from a reliable source, and not from the suspected e -mail.

4. Do secure your computer. Use updated anti-virus software, personal firewalls and apply latest security patches for your operating system and browser to secure your system from unwanted incidents. Anti-spam software can also help stop phishing e-mails from getting into your inbox. Some phishing e-mail may try to release a virus onto your computer.

   Internet Explorer (IE) users can download a special patch to protect against certain phishing schemes.

   The download is available at:
   http://www.microsoft.com/security/

5. Do report suspicious e-mails to the legitimate company, to your Internet Service Provider (ISP) or to your Computer Emergency Response Team (CERT).

6. Do review your credit card and bank statements regularly to check for errors or unauthorized transactions. If anything looks suspicious, do contact your bank and all card issuers.

7. Do install a Web browser tool bar to help protect you from known phishing fraud websites.

   EarthLink ScamBlocker is part of a free browser toolbar that alerts you before you visit a page that's on Earthlink's list of known fraudulent phisher Web sites.

   Free download is available at:
   http://www.earthlink.net/earthlinktoolbar

8. Do consider protecting yourself from dangerous scripts and spammers and phishers. Software such as the latest version of Outlook Express does make it much easier to do this.

3) Reporting a phishing case

Upon receipt of a report from user, Malaysian Computer Emergency Response Team (MyCERT) will perform below:

1. Verify the existence of the reported phishing site and check if the phishing site is still online or offline.

2. Find out the administrator/location of the Internet Protocol (IP) address where the phishing site is hosted by using 'whois' search tools. 'Whois' is an Internet database that provides information on a person or an organization.

3. Communicate with the administrator of the IP to shutdown the phishing site immediately, within 3 hours if the phishing site is hosted locally and within 24 hours if the phishing site is hosted overseas. For phishing sites hosted overseas, a copy of the notification will be carbon copied to the respective CERT of the country.

4. Monitor the phising sites from time to time if it is still online after notifying the relevant parties, locally and overseas. If it is still online, we shall send reminders to the respective parties.

5. Phishing sites that are not shutdown within 24 hours of notification, particularly the ones hosted on foreign servers, will be referred to the Law Enforcement Agency, the Malaysian Communications and Multimedia Commissions (MCMC), for further action.