Basics4Mac - Phishing pt 2 - Identify fake links

Protecting your private information

Legit HTML message
Click to see a larger image

This is a follow up tip to Beware of Phishing Emails. If you haven't read that tip it would be useful to read it first.

The first tip on phishing refers to hidden links in the email message. This tip gives more detail about these hidden links.

There are two types of email messages: plain text and HTML. Plain text messages can contain links and attachments (photos, etc.) but there is no hidden content. HTML messages are more like web pages. They contain formatted text and graphics. There is hidden code in the email message that tells Mail how to display the message.

Phishing emails are always HTML messages. They use the hidden code to generate the fake links that attempt to trick you into going to one website when they are really sending you to their website in order to steal your information.

Mail has a way to show you the hidden link. You can look at the hidden link and compare it to the link that you see in the message. If they don't match, chances are good that you are being phished.

Hover the mouse pointer over the link in question. A pale yellow box will pop up that shows you the hidden link.

Phishing HTML message
Click to see a larger image

The images at the right shows two different HTML emails from banks. The first image is from my bank, National City. You can see that the hidden link will take you to a page on National City's website. The second one is the phishing email from the first phishing tip that is supposedly from Bank of America. You can tell by looking at the hidden link that you will be taken to some remote site that is clearly not a Bank of America page.

One final comment on phishing: As careful as you are, it is always possible to be tricked by phishing. Since I got phished on my eBay account, I never click links in email that purport to take me to financial websites or other sites that store personal information about me. I go to Safari and go the website directly. That way, I know for sure that I am not being phished.