Community poll forum: 3/15/05 Are you afraid of identity theft from pharming?

From your description, your husband was phished, not pharmed. Pharming isn't something where you click on a link in an email that takes you to somewhere else. It occurs when you type in an address in your browser and the DNS server has been compromised so that it points to the wrong IP address. Much more insidious than phishing ever was.

DON'T TRUST the Verisign Program linked with Chase Manhattan Bank. I used my visa card in August 2004 while making two purchases on the internet, within minutes of each other. I made my purchases using the Verisign program. 3 days later, while I was at work, I received a call from Chase Manhattan regarding a $400 purchase made with my visa. The purchase was made while I was at work and I had my visa in my possession. Chase said they would not honor the purchase because I denied it and it didn't match my spending pattern. 6 months later and after many attempts to fix the problem, I ended up paying for the purchase because Chase said I had authorized it using the Verisign program. Somehow the person/s who made this fraudulent purchase was able to intercept my information through the Verisign program and make the purchase. Since then, I've canceled my Chase Visa card and don't make purchases over the internet. Your personal financial information is never secure - no matter what you are told. On the other side of the supposedly encrypted transaction - is someone to receive it. The only reason I paid this bill was I should have never trusted Verisign in the beginning, and didn't have time to put anymore effort into it; so this was a wakeup call. For a purchase of $400 I would have demanded a signature be required upon delivery.

Can you tell me how to find the IP addresses of the financial firms and how to place this info on the
"Host file" on my pc. Is Mac any safer? Pachelbel

I've been phished many many times and usually forward a copy of the phony message to abuse @... with long headers. I've never been pharmed but it's scary because I do use my credit card to pay on the internet, Does anybody have advice about Paypal? I use it, but I've been phished on it

I get dozens of Fhishing Scams a day in my e-mail; I just delete anything from any bank. Believe me I get them from banks (well not the Real McCoy of a bank). What these low lives do is set up a web site that looks like the REAL bank, then send out 1,000s of e-mail just hopping that a DUMB Un expensive person will open it and click on the link. DO NOT FOR ANY REASON CLICK ON ANY LINK IN ANY FINANCIAL COMPANY E-MAILS. 1. NO BANK is going to send you any email asking you for any information! Even if the bank was to have an accident and burn down: They still will not ask for your info. As they have in file off site. They even advised that my account would be locked down with no access. DELETE THE E-MAIL, THEN DELETE THE DELETED FILE OR IF YOU HAVE A PROGRAM THAT IS WIPE IT OUT TOTALLY. DO IT. When you do use a website with any info secure or not SIGN OFF! CLOSE the browser. Keep up all of your security programs current and WORKING.

It's time that the industry and consumers stop taking a passive role in combating these kind of threats. One way to better secure banking information would be for the bank to send it's customers mini-CDs or business card CDs with strong encryption codes that would be required in order to log-on to your account. One of the main benifits of this concept is that not only will the bank be able to verify it's clients better, but this will also allow the client to identify the bank.
Implementing such a practice is in the best interest of the banks. Consumer confidence is one of their most important issues. Even if they don't like the CD idea, they might think about using RFID tags and selling readers to their clients at huge discounts. It would be a huge mistake to put the key tag in credit cards for obvious reasons, so they would have to be issued on a seperate device.

My solution to pharming is a non-technical one and althought somewhat cumbersome it should work reasonably well until more complex technical measures can be implemented. Simply validate the site by initially entering a correct login with an incorrect password. If accepted then you know the site is NOT authentic. If rejected then enter the correct password. As an additional measure once you are sucessfully logged into your account, before entering any information simply preview existing info. If it is not available then the site is bogus. Basically use good old fashioned "common sense" and check everyone out before entering any private info on ANY website. Don't RELAX... If you are relaxed then you are getting 'hacked'.

While Pharming is a potential danger the chances for someone getting access to corporations DNS servers are probably low. With that said it's not impossible and we do have to watch out. A bigger danger lies for wireless laptop users that connect to open wireless access points. When you connect to an open access point you find yourself at the mercy of the network administrator. This means that they can alter local DNS records and route you to a different site. This is where HTTPS becomes important and you should check you have an https on the address bar; but there is one problem with this. They can have a secure certificate on the server and you will get a popup window; which talks about having a problem with the certificate; if you decide to continue you will see https. While the communication is secure it's secure with the wrong server. Also if the hacker alters the routing tables on the access point (easily done in Linux access points) they can make an IP address point somewhere else; which most of have seen in hotels and coffee shops, when you open your browser it goes to another page. While the threat from these attacks are not as great as altering DNS records we need to be careful because these types of attacks are practically undetectable and are very easy to execute.

Stay Safe,

Henry