Phishing for dollars...

A friend of mine called me early this morning with a computer emergency.  Apparently his Hotmail account was locked out and several of his friends had received emails that my friend was in a foreign country, had lost his credit cards, and needed $2,500.00 to be sent by Western Union so he could get home.

Further discussion revealed that my friend had received an email earlier in the week which was apparently from the Hotmail staff claiming to be performing an account update, and asking him to verify his date of birth, country of origin, and password (the criminals were "phishing" for information).

My friend complied with the official-looking request, and sent off the information.  Fast forward to the present, and my friend sadly realized that the request was bogus, and was used to gain access to his hotmail account and address book (caught the "phish" - hook, line, and sinker!).

Once the criminals had access, they sent out the "Help! I need $2500 now!" requests to everyone on his address book, and also likely reviewed all of his email folders for other juicy tidbits of information such as credit card numbers, expiration dates, banking information, other account credentials, etc.

I recommended that my friend contact his bank and credit card companies to put fraud alerts on the accounts, and change the passwords/PINs.  In the case of the credit card companies, they erred on the side of caution, closed his accounts, and issued new cards with different numbers/PINs.

Apparently a number of people reported or complained about the spam, or Hotmail detected the intrusion after-the-fact, because my friend's hotmail account was locked out.  The password couldn't be automatically reset because Hotmail had also closed the account to prevent the spammers from resetting the password and regaining access.  In order for my friend to regain control of his account, he's going to have to complete a detailed questionaire and hope that Hotmail grants access to his account again.

In the meantime, he's unable to use that email account, doesn't have access to the address book, or the old emails in the folders.  Accounts which sent email to that address have their emails bounce back.  As a result, my friend's also had to contact AT&T and some other utilities to make them aware of the situation, and to have them change account numbers for my friend.

In short, the whole thing's been a big ugly mess, and as a result my friend has learned a tough lesson on dealing with people on the Internet.

So that you, kind reader, don't get burned as well, here's some simple rules to live by:

* Use a strong password.  At least 8 characters.  Include UPPER and lower-case characters, and numbers.  Use a different password for each account.  Keep track of your passwords with a strongly-encrypted digital wallet.

* NEVER, EVER respond to anyone electronically who asks you for personally identifying information, or account credentials because they need to "verify it" or are "updating accounts".  The companies who created the account for you don't need it.  So unless you've called the company, initiated the dialogue, and they're verifying your security question/answer (mom's maiden name) - just delete the email.

* NEVER, EVER send money via Western Union, Paypal, USPS Postal Money Order, etc. to someone because your friend is "in trouble".

* Just because you're on the Internet doesn't mean that you shouldn't have your street-smarts antennae up.  You most definitely should because crime isn't simply local to your street, it can happen from around the world by someone claiming to be in the United States, who's accessing an account from a hacked computer in Bulgaria, while they're sitting in a Romanian village!

Stay safe!  If you have questions about these kinds of scams, feel free to drop me a note in the comment section below...