Below is the text of an email I sent various friends of mine shortly after my minor experience with the increasingly common crime of identity theft. It is fairly self-explanatory, but was to become a major factor in my decision to move from my old ISP Ridgenet to Earthlink, despite having to move my large website about the science fiction author
A.E. van Vogt.
----------
From: Isaac Wilcott
Date: Fri, 27 Jun 2003 19:36:20 -0700
To: [various friends]
Subject: A Warning
Hello all,
I'd like to share a recent humiliating experience with you all and hope that you learn from my mistake and are able to use this information to protect yourselves in future. I've learned quite a lot in the last two days, and know I'll not make the same mistake twice!
I recently fell afoul of the increasingly common crime of "identity theft." Yesterday around noon I received a fraudulent email purporting to be from the online auction site eBay (with whom I do business from time to time). It looked exactly like any email eBay would send out: nice graphics with the eBay logo, the same font they use, etc., and even the sender's address said "aw-confirm@ebay.com". Over the past few years, I have received several emails from that exact address that I know for a fact were indeed from eBay.
This email was a blank form, requesting that I confirm my personal information to update their records and ensure the security of my account. I saw that the email was one of these things that was tied to a web page, so I knew I'd not be sending such information through email.
Thinking this was nothing more than a routine bureaucratic bit of nonsense, I filled it out. I gave my eBay user name, eBay password, credit card number (ostensibly for identification purposes, a fairly common practice), and social security number (again, for ID purposes; it's technically illegal to use it for ID, but everybody does, from banks to doctors to businesses and government agencies). I then clicked the "submit" button at the bottom of the page which I knew would open my internet browser and send the information I filled in to eBay's server.
Much to my surprise, when my browser opened and the URL automatically entered, rather than a "Thank you for updating our records!" message on an eBay server coming up, I got a "No such address or device on this server" message. Looking closer at the URL, I received a nasty shock. "eBay" was nowhere in the address, and the last bit of the URL had stuff like "/%Isaac%Wilcott%" that set out in a list all my personal information. I now know that this is how the scam worked: whenever you try to access a page that is not on a server, the incorrect URL is logged along with when it happened for the system administrator to look over. This email form was configured to take everything I wrote into the blanks and turn it into a URL address with their server as the domain name. So all these criminals have to do is check the system administrator's logs and read the list of incorrectly entered URLs if they themselves run that domain name, then they can do that quite easily; and if not, they can just as easily hack into the server and pretend to be the administrator.
At the moment, though, I was merely growing more and more uneasy with this for all I knew, it could've just been an error or something. I figured the best way to see if this was a genuine eBay message or not was to contact eBay and ask them if they've sent out such messages. Digging through their help pages for contact information, I came upon a whole list of frequently asked questions regarding forged emails and sites purporting to be affiliated with eBay.
As I read more and more, I realized I had been expertly deceived and had given all this personal information to some crook. One page stated that eBay never requests such personal information through email, and never that kind of information even when you register as an eBay user. They described a common type of scam called "spoofing" computer experts and programmers are able to create any kind of information, including sender's addresses and even intricate forgeries of any company's emails, as well as URLs so similar to a business' that you have to read every letter of it and compare it with what you know to be genuine URLs. Criminals with these skills often impersonate big businesses to steal personal information, which they then sell in bulk to third parties who actually use the information to run up your credit cards, or impersonate you to try to receive various government benefits.
One page in eBay's help center in particular was a real life-saver, and I recommend you all read it: http://pages.ebay.com/help/confidence/problems-identity-theft.html. Without that page, I would have been completely and utterly at a loss for what to do, and would have switched from FRANTIC PANIC gear into SUPERPANIC OVERDRIVE. I sincerely thank whoever wrote that page!
The first thing I did was deal with the greatest threat: the credit card. I called my credit card company and a wonderfully helpful and understanding lady named Christine (bless you, Christine!) quickly closed and deactivated that account, advising me to destroy my credit card immediately, and notify any company that automatically charges my card on a regular basis (such as my internet service provider or any magazine subscriptions).
Thankfully, since I found out so quickly after I was scammed what had happened, the criminals had no opportunity to use my card number. I shudder to think what would've happened had I not immediately become suspicious and acted on it!
I also had to call one of the big credit agencies (Equifax) to put a "fraud alert" on that credit card number. (Thankfully, Equifax said they'd contact the other two big credit agencies, saving me 2 additional time-consuming and unpleasant phone calls.) I had to repeat that procedure with the Social Security Administration, the Federal Trade Commission (many thanks to the friendly and beautiful-sounding Debbie!), the local police (filing an identity theft report), and my bank account. These last two days have been stressful, frightening, and incredibly unpleasant. It still makes my stomach churn whenever I think of what happened, and how stupid I was to be taken in.
More people need to know about this kind of scam, what methods they use, and how to avoid it. If I had known even one simple, basic fact this whole situation could've been avoided: I did not know that email addresses could be forged. If I had known just that, I would've opened that email, thought to myself "Hmmm, this probably isn't from eBay" and dumped it in the trash with no further thought.
Try to understand how these people operate. Do some research into identity theft and how to avoid being deceived and robbed. Be paranoid. They are people out there who could pull the wool over the eyes of even professional computer programmers with a few well-chosen keystrokes on their laptop. But, most of all, be very cautious and very paranoid!
Oh, and did I mention you should be very paranoid?
With the sincere hope that you all have the good fortune to avoid such messes,