The Red Brick Times

As startling as Russ' last post is there are a couple of simple things you can do to protect yourself and your information.

1. NEVER, NEVER, NEVER follow a link in an email to a financial site. If you get an email that seems legit. Open a browser and type in the site address manually or use a Favorite/Bookmark if you have it set up.
2. Any time any legitimate site begins asking for sensitive personal information check the address, if you don't see https:// instead of http:// (note the added s) DON'T FILL OUT THE FORMS.

How's this scam work, then?

Web pages you see are answers to requests you have sent to another computer (server). Once the answer is returned to you the 'connection' between you (the requester) and the server (responder) is severed. Each click is a separate and distinction request/response cycle. BUT ...

Though the use javascript/vbscript and others it is easy to impersonate another site. It is not that the scam artists have hacked the financial institution computers, they haven't (if they had they would not be asking you for details, they would already have them). What they do is open a fake site, then use hidden elements to link to the real site and direct the displays to show any publicly available information (like a branch locator service) on the fake site. They can do this because 'public service' stuff is available through http:// and has to be so potential customers can use the site without having to log-in to an established account. The hackers/scammers CANNOT link and capture the parts of the financial site that are using https://.

What should a well-designed, public web site for a financial institution do to protect us?

The financial institutions can, during the request/response cycle, ask for some information from the requester (you) before sending a response back, including, but not limited to, 'what is the address currently displayed in the address field of the requester's computer?' By checking it and verifying there is nothing untoward in the address the financial site server can do a high level - low security check to be sure their site isn't being dragged into a spoof site. If the returned address is suspicious then there are steps the financial site server can do (just like Netcraft does).

In addition, depending on the design technology used, more complex analysis of the 'conversation' can be done increasing the security assurance from low to medium.

You best defense is you !

NEVER give sensitive information to any web site that isn't using https://.

Posted 11:57 AM by jeichenlaub (0) comments

       Comments:

Post a Comment


---