Blue Collar Computing

Recently several customers had asked us about an email they received claiming to be from the IRS. The email said that they had unreported income and that they needed to click a link to provide important information. They were skeptical and rightly so. This is a tactic known as phishing. In case you're wondering, phishing is the act of luring someone on the Internet to provide personal information such as passwords and social security numbers. It's a method of 'social engineering'. As with scam emails you may have received in the past, the first tip off is when they ask for information without verifying they know who you are. By using a reputable company or organization name, such as the IRS, the scammers hope that you won't think twice and will provide whatever information requested. They simply ask you to click a link that takes you to a website which will be designed to look like the company they falsely represent. They will use the same logos and sometimes the exact same website design that the real company has. An easy trick to be able to detect if the email in question is a scam or not, is to mouse over the link. Simply put your mouse cursor over the link they want you to click on and then look at the bottom of your screen to see the entire link. If you don't see the actual link when doing a mouseover, right click and copy the link location. Then go to a document editor and right click and paste. This will show you the true link. Typically what the text in the email shows for the link, will be different than what the actual link is. For example: Text link in email: http://www.irs.gov/update Actual link revealed after mouse over: http://www.irs.americainfo.com/update While they look quite similar, there is a big difference in these two links. The text shown, and the actual link can be quite different. The first link would take you to the legitimate IRS website while the second (where the link actually goes) would send you to a part of some website called americainfo.com. This would be a compromised server that was taken over to collect personal information through the email scam. As always, when in doubt you should contact the company in question. If it's a company you've done business with before, call them directly with a known valid number and inquire about the questionable email. They'll be more than happy to clarify and also to know if someone is using their company name for a scam!