Online Identity Theft

Spoof Email Hoax scams and Fake Web Pages or Sites

by Mat Bright
27th June 2003 (last updated 23rd February 2004)

Part Four

How do hoax email scams work to commit fraud?

The actual mechanism by which this theft occurs is quite simple, if the spoof email does not present you with a form to enter sensitive data, it will attempt to direct you to a genuine looking but forged web page or site. There is an eventual point at which the theft occurs, but it is not always from within the email itself. So, at some point you will be asked to enter your login info and/or credit or debit card number(s), bank account details and perhaps your social security number (you might even be asked for the answer to your password reminder question in an attempt to add a further sense of authenticity).

Once this is done, the sensitive information is relayed to, or retrieved, by the fraudster(s) with the clever use of some code in the email, web page, by utilising an online mail form processing service or by hacking into an existing one (in many cases a high level of knowledge in web design is needed).

In most cases, the perpetrators will want your information to gain control of things like your eBay account, Credit Card and email account and they may further utilise any information you inadvertantly give them to gain credit in your name. This can destroy your financial status quite quickly and recovery can be very lengthy and difficult. America's Federal Trade Commission (FTC) reported that in 2002 the highest percentage of stolen identity information was used to open new accounts (24.4%).

These are very serious acts of fraud, and there have been examples of successful Identity Thefts utilising email or the internet and involving large sums of money - for instance the Nigerian 419 scam or the one man Buffalo Spammer who 's court papers cited his distribution of around 825 million spoof emails and the theft of 343 identities. The really worrying part of this is the potential to fall victim - MailFrontier recently reported that over 40% of recipients fell for the recent Citibank Email Scam.

Let's now look at what to do if you receive a spoof ...