Users of online services are potential targets for attempts to steal login credentials and other sensitive information. These threats include scam emails (phishing and malware) and phone calls attempting to gather information that can be used to gain unauthorized access or privileged knowledge.
Don't become a victim of "phishing," in which Internet criminals set up a Web site that mimics a legitimate site, such as the salesforce.com login page. By following the tips below, you can avoid becoming a victim of such a scam:
Phishing emails try to trick you into revealing information, often by asking you to "verify" or "update" information. Such emails may use the logos of the companies or government agencies they are impersonating to look legitimate.
One clue is that such messages often contain poor spelling and grammar. However, as scam artists become more sophisticated, their approaches are becoming more varied as are the messages and who they claim to come from.
The example below shows some common phishing tactics, but expect anything - as users catch on to one approach, Internet criminals come up with new ones.
Remember, legitimate businesses will not ask you for sensitive information via email. If you receive such emails, do not respond or click any links the email contains. Forward the mail to firstname.lastname@example.org and then delete it.
Malicious software attacks also come via email, using many of the same tactics as phishing. These emails include links or attachments that install malicious code—such as programs that capture keystrokes—on your computer. As users have become wary of attachments with .exe or unknown extensions, Internet criminals are now using attachments with seemingly innocuous .doc or .pdf extensions. And most users still readily click on links.