My ‘little’ brother (also a CHL Instructor) has been collecting and investigating phishing and related scam emails lately. Here is one of the ‘better’ ones, employing some fairly sophisticated social engineering:
From: REGIONS [email deleted to protect the clueless]
Date: Sat, Feb 6, 2010 at 4:39 PM
Subject: REGIONS INTERNET BANKING
To: [deleted: one of my little brother's emails]REGIONS INTERNET BANKING
Dear Customer
Attention! We have just upgraded our online portal.
Please click the link below and enter your account information.
You have 12 hours to confirm account information or your account will be blocked.
To Get Started, Please Click On Restore Your Regions Account Access.
Please visit [url deleted to protect the clueless]Regions provides individual investors with sound financial advice whether from your local branch or our expert investment services.
Thank you for using Regions Online Banking.
Equal Housing Lender (c) 2010 Regions Financial Corp. All rights reserved.
The website is fairly well-designed, too. It looks like a true banking site and uses the premise that your account will be shut down if you do not sign in.
If you examine the links on the page, you will see that they all forward to the page you are already looking at. It points out that,”if you have not checked your account since July14th, your account must be updated”. Then it gives you a place to put your username and password. If you don’t know your password, you can enter you secret answer(s) to your secret question(s) [generally: your place of birth, your mother's maiden name, your father's middle name, or the name of you favorite pet]. If that does not work for you, then it allows you to enter another site that will allow you to use your credit card, SSN, and some other information to re-access your Regions Banking Account.
Most people only have one or two usernames and passwords that they use for all secure sites. Entering them in the first page will send these to the scammer. Next, if you go to the page to answer the secret questions, that gives them the information that most people don’t bother to think about being secure. Then, you are sent to a page that allows you to use your credit card, SSN, and other info to finally get ‘access’ to your account. It doesn’t really even matter if you don’t have a Regions account (I don’t); the scammer now has everything it needs to implement a successful identity theft.
According to Little bro’, this is the sort of scam his ex-wife would definitely fall for. Every. Time. (He didn’t say which ex, but I can guess
)
BTW, here’s my way of dealing with passwords. I use PWGen (a free, open-source password generator available through SourceForge). I generate the longest, most secure password that a particular website will accept, and then store the result in a spreadsheet, which I have encrypted with a passphrase that I don’t use anywhere else. There is also a free, open-source program called KeePass, which does something very similar, but I’ve found that the spreadsheet approach works a bit better for me, because I add a column to record the last date each password was last changed — and I change them on a regular schedule.