Fraudulent Email - Thieves Intend to Steal Your Personal Information

How the Scam Works

Crooks are continuing to unleash fraudulent email scams at a ferocious pace. Many of these are designed to trick consumers into parting with their valuable personal or financial information. For information on current email scams, the Attorney General recommends visiting websites that track phishing frauds and provide informational updates for consumers.

This type of scam, often referred to as "phishing" or "carding," begins with emails that are carefully constructed to look like legitimate messages from familiar businesses or government offices. The crooks lurking behind these messages often weave plausible stories related to customer-service or security needs, which direct consumers to click on hyperlinks contained in the messages to clear up the purported problem. But the links lead the unsuspecting victims to phony imitations of legitimate websites, often hosted by Web servers in foreign countries, where victims are induced to relinquish valuable personal information in order to “verify” or “confirm” their account information. In an effort to distract consumers, scammers often conclude the interaction by redirecting unwitting site visitors to a legitimate website.

And so begins a series of fraudulent transactions perpetrated by identity thieves in the victim’s name.

One prevalent type of phishing scam starts with a fraudulent email from popular online merchants, such as eBay, PayPal, or the email looks almost exactly like a typical order confirmation message, which businesses commonly send to consumers who recently made a purchase online. Scammers often put an order number in the subject line of the email in order to lure consumers into opening the message.

Another type of phishing scam email that has recently been circulated is an email asking you to confirm, validate, or verify your username or user id. For example, an email from “Apple” could ask you to verify your account or Apple ID and provide you with a link that clicking on would be harmful. Not only is responding to these types of emails dangerous, but even the mere act of opening the message or clicking on links can unleash a dangerous virus or “spyware” onto your computer. 

Do not provide personal information to someone who calls or emails you.

Regardless of whom they claim to be, people who call or email you seeking personal or financial information should be treated as potential thieves who may be trying to steal your identity. Resist their alarming or believable scenarios and urge to update, validate, or confirm sensitive information. Do NOT provide people who call or email you with any personal information. Remember, identity thieves are crafty, and they may be attempting to contact you numerous times using a different alias for each email.

Protect Yourself

• Be cautious about opening any attachment or downloading any file from emails you receive, regardless who sent them. These files can contain viruses or other software that can weaken your computer’s security.
• If you get an email or pop-up message that asks for personal or financial information, do not reply. And don’t click on the link in the message, either. Legitimate companies don’t ask for this information via email.
• If you receive an email from a familiar online merchant, make sure that before opening, you compare the order number in the subject line of the email to the receipt you printed from the merchant's website when you completed your order. Also, look for a digital signature. If the order number in the subject line does not match the order number on your receipt, do not open the email! Delete it immediately.
• If you are concerned about unauthorized activity in your account, contact the organization mentioned in the email using a telephone number you know to be genuine, or open a new Internet browser session and type in the company’s correct web address yourself. In any case, don’t cut and paste the link from the message into your Internet browser – phishers can make links look like they lead to a familiar Web page when in reality they point to a fraudulent look-alike site.
• Install protective anti-virus, anti-spyware, and firewall software, and keep them up-to-date. Some phishing emails contain software that can harm your computer or track your activities on the Internet without your knowledge. Anti-virus software and a firewall can protect you from inadvertently accepting such unwanted files. Anti-virus software scans incoming communications for troublesome files. Look for anti-virus software that recognizes current viruses as well as older ones, that can effectively reverse the damage, and that updates automatically. A firewall helps make you invisible on the Internet and blocks all communications from unauthorized sources. It’s especially important to run a firewall if you have a broadband connection. Operating systems or browsers also may offer free software “patches” to close holes in the system that hackers or phishers could exploit.
• Check your browser (Firefox, Internet Explorer, Chrome, Opera, Safari, etc.) to see if it has anti-phishing features, such as a toolbar that compares websites you attempt to visit with known phishing sites.
• Don’t email personal or financial information. Email is not a secure method of transmitting personal information. If you initiate a transaction and want to provide your personal or financial information through an organization’s website, look for indicators that the site is secure, like a lock icon on the browser’s status bar or a URL for a website that begins “httpS://” (the “s” stands for “secure”). Unfortunately, no indicator is foolproof; some phishers have forged (“spoofed”) security icons and “https” sites.
• Forward (don’t open and copy!) the entire email you believe may be a phishing scam to the Federal Trade Commission (FTC). Also forward the email to the company, bank, or organization impersonated in the phishing email. Most large companies have information on their legitimate websites about phishing scams and a special email address for reporting problems.
• Review credit card and bank account statements as soon as you receive them to check for unauthorized charges. If your statement is late by more than a couple of days, call your credit card company or bank to confirm your billing address and account balances.

For Victims

Victims of phishing may become victims of identity theft. Tips for minimizing your risk and other information related to ID theft are outlined in the Attorney General's Identity Theft Consumer Alerts.

If you believe you’ve been scammed out of money in a phishing scheme, visit the FTC’s Identity Theft Website and file a complaint with the FTC.

If an identity thief opens credit accounts in your name, these new accounts may appear on your credit report. You may catch an incident early if you order a free copy of your credit report periodically from any of the three major credit bureaus. Read the Attorney General’s Consumer Alert, “Free Annual Credit Reports-What Consumers Should Know” or visit the Annual Credit Report website for details on ordering your free annual credit reports.

Contact the Attorney General’s Office

For general consumer questions or to file a complaint, you may reach the Attorney General's Consumer Protection Team at:

Consumer Protection Team
P.O. Box 30213
Lansing, MI 48909
517-335-7599
Fax: 517-241-3771
Toll-free: 877-765-8388
Online complaint form