Speaker 1: Brought to you by the reinvented two thousand twelve Camray.
Speaker 1: It's ready. Are you get in touch with technology? With
Speaker 1: tech stuff from how stuff works dot com. Hi, everybody,
Speaker 1: welcome to the podcast. My name is Chris Pollette. I'm
Speaker 1: an editor here at How Stuff Works, and sitting next
Speaker 1: to me, as always, is senior writer Jonathan Strickland. Hey there,
Speaker 1: that was just for you, Chris. Thanks welcome. I appreciate
Speaker 1: that you sure. Are you sure that's you and not
Speaker 1: somebody else? I'm pretty sure it's me this time. Uh,
Speaker 1: they look like you, but I can't. Yeah. We wanted
Speaker 1: to talk today about kind of an insidious problem that's
Speaker 1: on the internet, although it didn't officially you know, start
Speaker 1: on the internet. It's actually older than the Internet is.
Speaker 1: But we're talking about phishing scams, and that's fishing with
Speaker 1: a pH Yeah, that's true. Um, the these these are
Speaker 1: social engineering scams. There. They're little ploys designed to trick
Speaker 1: you into giving away your personal information. Yeah. And the
Speaker 1: bait that they use, which is part of why it's
Speaker 1: called phishing, is uh, it usually plays usually plays upon
Speaker 1: your baser personality traits. Let's say like greed. That's a
Speaker 1: big one. In fact, that's probably the main one, but
Speaker 1: other ones like Vanity also play a part in certain
Speaker 1: uh phishing scams. So let's let's talk about a couple
Speaker 1: I wanted to talk about probably the best known scam,
Speaker 1: especially when it comes to email scams, which is the
Speaker 1: Nigerian email scam or the four one nine scam. Well,
Speaker 1: you know, I was actually contacted by somebody in Nigeria. Yeah,
Speaker 1: and they said if I just gave them some personal information,
Speaker 1: they would uh millions of dollars. Yeah, that's that's the
Speaker 1: basis for this scam. Now, the original scam was not
Speaker 1: a phishing scam originally it was it was just so
Speaker 1: that you would send them money, so you would wire
Speaker 1: this person money directly, um. But they would not have
Speaker 1: access to your personal information, just your money. So hey,
Speaker 1: there's a bright side, right. But they they have kind
Speaker 1: of evolved since then, and often you will find these
Speaker 1: these um emails. Uh. They're called Nigerian scams because a
Speaker 1: lot of them do seem to originate from Nigeria. UM,
Speaker 1: not all of them. They could be from anywhere. It's
Speaker 1: just that's the name they've been given. And the claim
Speaker 1: is that there is an enormous sum of money that
Speaker 1: they're trying to get. This person is trying to get
Speaker 1: out of whatever country they're in, and they want to
Speaker 1: use you as an accomplice to hold onto this money.
Speaker 1: And you get to keep a portion of that money
Speaker 1: as as part of the deal. And as the deal
Speaker 1: goes on, things start to mess up and the person says, oh,
Speaker 1: you know, um, I've got to bribe this this official.
Speaker 1: I'm gonna need a thousand dollars from you so that
Speaker 1: I can bribe this person and then we'll be able
Speaker 1: to get you the millions and millions of dollars. And
Speaker 1: with that promise the millions of dollars, lots of people
Speaker 1: are willing to part with substantial sums of money thinking
Speaker 1: they're gonna get practically something for nothing. And there are
Speaker 1: people who have lost hundreds of thousands of dollars in
Speaker 1: these scams. That's true, Um, and uh, it's it's kind
Speaker 1: of impressive the list of people who have gotten caught
Speaker 1: by these scams, including Harvard professor a few years ensnared
Speaker 1: by one of these these ploys. Um. They actually found
Speaker 1: out he had been embezzling a little bit himself, and
Speaker 1: well he lost it all when he sent it to Nigeria. Right, Yeah, this'
Speaker 1: it's it's one of those things that just um it's
Speaker 1: it's just evil, evil scheme that that has taken lots
Speaker 1: of money from people who were a little naive and
Speaker 1: a little greedy and way too trusting, so less than one.
Speaker 1: Don't trust everything you see on the internet. Um, that's
Speaker 1: that's probably the best thing to keep in mind while
Speaker 1: we're talking about all these fishing schemes. You know, like
Speaker 1: the old thing goes, if it seems too good to
Speaker 1: be true, it probably is. Yeah, definitely, But um I
Speaker 1: always one of the one of the sort of asides
Speaker 1: for this part of the h our discussion is, um
Speaker 1: the people that have started counter scamming the scammers, which
Speaker 1: just tickles me. No end there there. You can do
Speaker 1: a quick search on the internet and you can find
Speaker 1: people who are uh they respond to these scammers and
Speaker 1: they'll say, well, sure, you know, I'm happy to help
Speaker 1: you out, but first I need this from you, and
Speaker 1: they'll make them do these elaborate things. I saw somebody
Speaker 1: who made them carve a commodore sixty four out of
Speaker 1: wood and send it to them, and they showed pictures
Speaker 1: of it and it was amazing, right, So the people
Speaker 1: on the other end of the scam can sometimes be
Speaker 1: just as naive as the people they're trying to to
Speaker 1: lure into the trap and to get back into the
Speaker 1: fishing thing. The Nigerian scam, the way it's evolved is
Speaker 1: is instead of asking for money, they'll ask for things
Speaker 1: like your social Security number or your bank account number.
Speaker 1: And then once they have that in for nation, that's
Speaker 1: when you're really in trouble because not only will the
Speaker 1: siphon out all the money in your account, but they
Speaker 1: might also make you a a victim of identity theft. Um.
Speaker 1: That's the that's the main goal for probably most of
Speaker 1: the phishing schemes online, I would say is is some
Speaker 1: form of identity theft, usually some sort of credit card
Speaker 1: fraud or um or just outright theft of whatever's in
Speaker 1: your bank account. I use a m I use a
Speaker 1: web mail uh, pretty standard, well known web mail service
Speaker 1: for my main email account. If you look at the
Speaker 1: spam folder, it's pretty obvious that these things are scams
Speaker 1: because I honestly, every time I look at the spam
Speaker 1: folder and then it'll be a full folder. You'll see
Speaker 1: probably about a third of those have similar or the
Speaker 1: same exact uh subject headings. Um, and they'll all be
Speaker 1: you know, please or help me with my problem or
Speaker 1: you know, bless you you have uh, you have the
Speaker 1: way to help my you know, situation out and you're
Speaker 1: don't looking at your going okay, obviously there's something going
Speaker 1: on here. And you know, bank accounts, they'll say, you know,
Speaker 1: I'll get letters from banks that I never have had
Speaker 1: an account with saying you must update your account information
Speaker 1: as soon as possible otherwise, you know, or PayPal, you know,
Speaker 1: And I'm going, yeah, no, I know, you're not real
Speaker 1: That thing is they've gotten really sophisticated. They're getting a
Speaker 1: lot better but fewer spelling mistakes and things and including
Speaker 1: your name and things that might have clued you in before.
Speaker 1: Are they're yeah, they're fine. They're starting to starting to
Speaker 1: close those holes that that were that were in the
Speaker 1: their approaches before. Um. You mentioned the bank thing. That's
Speaker 1: actually a very good point. Uh. That's another one that
Speaker 1: plays on not so much a negative personality trade, but
Speaker 1: it plays on a person's fear. Yeah, you know, because
Speaker 1: if you get a message that's from your bank account
Speaker 1: or your your bank and it says, uh that there's
Speaker 1: a problem with your account. Obviously you're going to immediately
Speaker 1: want to try and address this problem. And um, the
Speaker 1: there's a kind of a sister technique to fishing called
Speaker 1: farming also with a pH which uh spoof's a website.
Speaker 1: The goal here is to create a website that looks
Speaker 1: identical to a real, um, respectable, legitimate website, so a
Speaker 1: bank will say that's a good example. Um, but the
Speaker 1: goal is not to let you access your account, but
Speaker 1: rather to collect user names and passwords. And uh, it's
Speaker 1: the same sort of end goal as phishing. It's it's
Speaker 1: collecting all this information and then just stealing everything you
Speaker 1: can possibly steal. Um, these are these are kind of
Speaker 1: scary things. I mean, that's really and anyone can fall
Speaker 1: victim to it. Uh. It's very easy to read one
Speaker 1: of these emails and get emotionally involved and act before
Speaker 1: you can really think things through. Yeah, and there's them.
Speaker 1: There's some ways that you can kind of tell that
Speaker 1: these these fights are real or not. You should always
Speaker 1: look when somebody tries to get you to go to
Speaker 1: one of these sites, take a look at the u
Speaker 1: R l UM and that's that's gonna be one of
Speaker 1: the first clues because a lot of the fishing UH
Speaker 1: emails that you'll see, we'll ask you to click on
Speaker 1: this link and if you mouse over it, you know,
Speaker 1: just hold your mouse cursor there and look at the
Speaker 1: the location for the site. A lot of times you'll
Speaker 1: see that it doesn't even have the name of the
Speaker 1: site that you're supposed to go to in it, So, um,
Speaker 1: that's a pretty good clue right there. Or they'll it'll
Speaker 1: be the name hyphen something else and you'll go, Okay,
Speaker 1: this seems a little odd. You want to see if
Speaker 1: the website has security that usually you can tell that
Speaker 1: by either looking for the little lock icon or the
Speaker 1: h T t P s in the u r L.
Speaker 1: Keep in mind that both of those can be faked. Um.
Speaker 1: You can even create a fake website that has a
Speaker 1: fake u r L that looks just like the real one. Um.
Speaker 1: There's a nasty, nasty attack called it donain domain name
Speaker 1: server poisoning where you can um spoof the whole thing,
Speaker 1: and that that's probably the scariest of all of them,
Speaker 1: because in most of these cases, a good point of
Speaker 1: advice is instead of clicking on a link to take
Speaker 1: you to whichever site you need to go to, like
Speaker 1: let's say Amazon or PayPal. UM, you type the address
Speaker 1: in instead and that way you don't have to worry
Speaker 1: about a link redirecting you to another site. However, with
Speaker 1: the d NS poisoning, it is possible to full computers
Speaker 1: so that even if you were to type the address
Speaker 1: and you will go to the farming site instead of
Speaker 1: the real site. UM. Not very widespread, but it is possible.
Speaker 1: This is one of those major major uh uh security
Speaker 1: leaks that came out over the to the year two
Speaker 1: thousand eight UM. Unfortunately, right now it hasn't become a
Speaker 1: major problem. It's just the potential for disaster. So um. Yeah,
Speaker 1: the fishing and farming, these are these are things that
Speaker 1: you definitely need to look out for. And there's some
Speaker 1: other general rules. If you ever get a message from
Speaker 1: your browser saying that the certificate it's asking for does
Speaker 1: not match the u r L, that is a huge
Speaker 1: warning that you should never agree to accept a certificate.
Speaker 1: If it's gives you that message, that's pretty good indication
Speaker 1: that you are you're in a farm farmed site, that's true,
Speaker 1: and you can It will usually tell you specifically what
Speaker 1: that u r L is. And if you look at
Speaker 1: that and that pop up window that you'll get, you're
Speaker 1: gonna see that the u r L doesn't necessarily match.
Speaker 1: And in some cases it will make sense to you, um,
Speaker 1: you know, there are some legitimate cases where it might
Speaker 1: be a little different. Um, but you should be able
Speaker 1: to look at that and puzzle it out for yourself
Speaker 1: and go that you know, does not make sense to
Speaker 1: me that this would go to this u r L.
Speaker 1: I don't think this is safe. And there are some
Speaker 1: browser uh you know, the newer browsers have some phishing
Speaker 1: anti phishing technology built into them. Yes, yeah, that's true.
Speaker 1: And we should also go ahead and move on to
Speaker 1: we were going to talk about some social networking sites
Speaker 1: recently that have had some issues with uh, with phishing attacks. Now,
Speaker 1: these are a little different, uh, and it's a it's
Speaker 1: a step further away from any money. You know, you're
Speaker 1: not you're not logging, you're not giving someone the information
Speaker 1: to your bank. However, if someone fishes your information from
Speaker 1: a social networking site, they may end up getting a
Speaker 1: password that works for other websites. If you're the kind
Speaker 1: of person who creates the one password and uses that
Speaker 1: for everything. If you get tricked once, that means your
Speaker 1: information is is vulnerable everywhere you go. UM. So that's
Speaker 1: one of the good reasons to make sure you use
Speaker 1: different passwords for different websites, which is a pain. I
Speaker 1: know it's a pain, especially if you have a lot
Speaker 1: of websites you go to. That's really important to do
Speaker 1: if you want to remain safe online. That's true. And
Speaker 1: there are some pretty sophisticated UM password storage sites that
Speaker 1: are available now UM and UH. Some of them will
Speaker 1: help you manage your your logins. They'll plug in, they'll
Speaker 1: offer a plug in for things like Firefox browsers like Firefox,
Speaker 1: you can plug it in and it will when you
Speaker 1: go to a site. It will allow you to store
Speaker 1: UM passwords. And some of them will even allow you
Speaker 1: to generate uh new passwords, so it'll be you know,
Speaker 1: you you can generate something with lots of different upper
Speaker 1: and lower case characters and numeric things and and basically
Speaker 1: help you to come up with something really tricky UM
Speaker 1: and you won't necessarily have to remember it because the
Speaker 1: plug in has it stored for you. Right and UH.
Speaker 1: Going back to social the social media stuff, UM, Facebook
Speaker 1: and Twitter both have had some problems with phishing attacks recently,
Speaker 1: and recently I mean the end of two thousand and
Speaker 1: eight and beginning of two thousand nine. Um. Facebook, Actually
Speaker 1: one of my friends on Facebook was victim to this. Uh.
Speaker 1: He he was suddenly sending out all these messages to
Speaker 1: people saying, Hey, you know, you look really funny in
Speaker 1: this video. I can't believe you did this, blah blah blah.
Speaker 1: And then there's a link, and the link takes you
Speaker 1: to a site that looks like a video site, and
Speaker 1: it tells you, Hey, you know what, you need this
Speaker 1: plug in in order to play the video. Click here.
Speaker 1: And if you were to click there, you would immediately
Speaker 1: download some malware onto your computer. And so uh, in
Speaker 1: this case, it's not necessarily to steal your information, but
Speaker 1: it was a malware delivery system which could theoretically also
Speaker 1: helps steal your information. It could be a key logger,
Speaker 1: it could be a trojan, ums, all sorts of things,
Speaker 1: nasty things that could happen to you by following these links.
Speaker 1: So we did let him know that his account was compromised,
Speaker 1: and um he ran some software and he changed his
Speaker 1: past words and things seem to be okay with his
Speaker 1: account now, but I've seen that happen two or three
Speaker 1: other times with other people. And the pernicious thing is
Speaker 1: on Facebook if you haven't used Facebook before, if you're
Speaker 1: posting something to somebody else's what they call the wall, right, Um,
Speaker 1: you have to be a friend of that person is
Speaker 1: in order to do that. So there's already that that
Speaker 1: aura of trust going on. You say, well, this must
Speaker 1: be legitimate, you know, And and even though there may
Speaker 1: be spelling errors or the grammar they use may not
Speaker 1: be the same way that this person would normally write
Speaker 1: to you, you might say, well, you know, obviously it's
Speaker 1: not somebody else because they're writing on my wall, so
Speaker 1: it must be legitimate. Well, that's the thing is those
Speaker 1: people are falling prey to the fishing attack, and then
Speaker 1: other people fall prey to it, and that's social engineering,
Speaker 1: right Yeah. Twitter was very much the same way. Um,
Speaker 1: a few Twitter accounts were compromised and in a way
Speaker 1: that as of the recording of this podcast, we're just
Speaker 1: not sure exactly how the the initial uh takeover happened.
Speaker 1: But after that, direct messages started going between Twitter users
Speaker 1: and and and just like in Facebook, to send a
Speaker 1: direct message, and Twitter you have to follow the person
Speaker 1: you're sending the message to and they have to follow
Speaker 1: you back. It can't just be a one way street.
Speaker 1: It has to be you know, mutual following. Then you
Speaker 1: can send a direct message, which is a private message.
Speaker 1: It doesn't go on the public Twitter broadcast. And these
Speaker 1: private messages said things like, oh, you won't believe what
Speaker 1: this person said about you in this blog, and you know,
Speaker 1: being the kind of vain people we are, we Twitter users,
Speaker 1: I include myself in that. Yeah, but in particular people
Speaker 1: who use Facebook and Twitter. There there's a few studies
Speaker 1: that suggests that such users have a little bit of
Speaker 1: a narcissistic tendency. Um well, you feel inclined to click
Speaker 1: on this, and of course that ends up delivering malware
Speaker 1: to your computer. So um yeah, these are We're probably
Speaker 1: gonna see a lot more of these, especially as people,
Speaker 1: you know, think people who think it's funny. Like the
Speaker 1: Twitter stuff. A lot of the things I saw were
Speaker 1: just people messing with other people's Twitter accounts so that
Speaker 1: they were making them say ridiculous and you know, scandalous
Speaker 1: things and completely untrue things. But they weren't using it
Speaker 1: to necessarily steal information. They were just making a nuisance
Speaker 1: of themselves. We'll probably see more of that too. Yeah.
Speaker 1: As a matter of fact, Um, there were several high
Speaker 1: profile accounts that were hacked right on the heels of
Speaker 1: that fishing scheme, like President elect Barack Obama and Britney
Speaker 1: spring Spears Fox News, Rick Sancho said, Rick Sanchez from CNN,
Speaker 1: I believe Rick Sanchez claimed according to his Twitter account
Speaker 1: that he had taken some crack early in the morning
Speaker 1: and was kind of flying high at the time. Yeah, yeah,
Speaker 1: that was not that was yeah, that was a bad one. Yeah,
Speaker 1: and patently, you know, completely untrue. Yeah, it was not
Speaker 1: Rick Sanchez, it was whomever had taken over his account.
Speaker 1: But apparently in that case, Twitter founder Biz Stone said
Speaker 1: that there were some tools, administrative tools that had gotten
Speaker 1: hacked into right that would allow someone to access passwords,
Speaker 1: and there were thirty three accounts they haven't divulged at
Speaker 1: this time at the time of us recording this who
Speaker 1: all was hacked. But they were all famous people with
Speaker 1: lots of lots of I mean, they were the obvious targets.
Speaker 1: And um, yeah, this is uh, And so don't think
Speaker 1: that President elect Obama saw Hey, see what this crazy
Speaker 1: person said in the blog about you and then clicked
Speaker 1: on it. That's not the case. In this case, he
Speaker 1: was he was targeted specifically by the hackers. This wasn't
Speaker 1: one of those things where Obama is just like I
Speaker 1: wonder what this blogger did say about me. Um. So,
Speaker 1: just to clear that up, I wanted to talk very
Speaker 1: briefly about what you should do if you are the
Speaker 1: victim of a phishing attack. Okay, so, there are a
Speaker 1: few different websites you can report a phishing attack to.
Speaker 1: One of them is the anti phishing dot org website,
Speaker 1: and you can send an email to report phishing at
Speaker 1: anti phishing dot org. Um. You can also send an
Speaker 1: email to the Federal Trade Commission, which is UH that
Speaker 1: the DEMAI address to send that too would be spam
Speaker 1: at u CE dot gov. And you would probably want
Speaker 1: to file a complaint with the FBI UH at their
Speaker 1: Internet Crime Complaints Center which is at www dot i
Speaker 1: C three dot gov. And it's important to let these
Speaker 1: these organizations know so that they can let everyone else
Speaker 1: know and investigate. Meanwhile, you should also immediately contact the
Speaker 1: three big credit bureaus so experience Equifax and TransUnion and
Speaker 1: get ahold of your credit report, take a look at it,
Speaker 1: see if there's anything strange on their report the fraud
Speaker 1: to them. UM, if you have evidence of fraud, you
Speaker 1: should use that so that you can get the fraud
Speaker 1: alert extended over the maximum amount of time, because standard
Speaker 1: time for a fraud alert is ninety days, and the
Speaker 1: problem with that is someone could still be using your
Speaker 1: information after those ninety days and you'd really be stuck.
Speaker 1: So if you have proof of fraud, you can get
Speaker 1: that extended up to I think seven years, UM, which
Speaker 1: you know it sounds kind of crazy, but you know
Speaker 1: we're talking about your information that can affect your credit rating,
Speaker 1: whether or not you can buy a house, whether or
Speaker 1: not you get a job. I mean, this is important stuff. UM.
Speaker 1: And also report the crime to local law enforcement. Uh,
Speaker 1: if it happened, you know, if it happened while you
Speaker 1: were at home, of course, that's you know, you report
Speaker 1: to that local law enforcement. If you're on vacation, whatever,
Speaker 1: you report to them, um, just to let them know
Speaker 1: what had happened. That kind of covers all the bases.
Speaker 1: You may have to sign some AFFI David's to make
Speaker 1: sure that you know you're what you're saying. You're you
Speaker 1: will stand up in court and defend and say this
Speaker 1: is exactly what happened. But that's a small price to
Speaker 1: pay considering. Yeah, I think so. And uh, you know,
Speaker 1: this is as Jonathan said, this is not something that
Speaker 1: you want to take lightly. Just use your common sense. UM,
Speaker 1: avoid clicking on links that that don't appear to be correct. UM,
Speaker 1: go directly to the source if you can to define it. UM.
Speaker 1: Use the latest web browsers to uh that incorporate the
Speaker 1: anti fishing technology. UM. All these things will help you
Speaker 1: help you avoid being sucked in. And uh, it's amazing
Speaker 1: to me how many of these deep sea analogies we have.
Speaker 1: Now we've talked about trolling and fishing. So yeah, it's
Speaker 1: so don't be a prawn. You know what else? Nice?
Speaker 1: Nice piracy? Right, So we've got a whole seafaring thing. Guy. Yeah,
Speaker 1: well I think that about wraps it up for this discussion,
Speaker 1: don't you. Yeah. Excellent. If you want to learn more
Speaker 1: about some of the things we've talked about, we've got
Speaker 1: articles on online crime, we have articles on uh safe
Speaker 1: web browsing. You can fishing fishing, both the PHM and
Speaker 1: f I believe you can find out all about that
Speaker 1: at how stuff works dot com right now, and we'll
Speaker 1: talk to you again really soon. We're more on this
Speaker 1: and thousands of other topics because it how stuff works
Speaker 1: dot com. Let us know what you think. Send an
Speaker 1: email to podcast at how stuff works dot com. Brought
Speaker 1: to you by the reinvented two thousand twelve camera. It's ready,
Speaker 1: are you