E-mail scams snare unaware

Fight against fraud becoming tougher

The e-mail looks official enough, asking Commerce Bank members to “safeguard” their accounts from “a large number of identity theft attempts” by requiring “that you confirm your banking details” online; otherwise, “your account or Credit Card may be subject to temporary suspension.”

One problem: It’s a scam.

The e-mail circulated during the weekend is the latest in a flood of “phishing” expeditions that use the Internet to snag personal financial information, preying upon people too nervous about their financial assets to listen to common sense.

Such scams — e-mails addressed to a generic “customer” who is instructed to divulge secret information — have become commonplace during the past couple of years, leading bank and other company officials to fight fraud with education.

“There’s always been fraud around,” said Cindy Tetrault, Commerce Bank’s manager of online banking and commercebank.com. “What the Internet has done is allow the bad guys to just do it on a much bigger scale than they could before. They don’t have to personally call everyone that they’re interested in pursuing. They just blast out 100,000 e-mails in a matter of minutes.”

Such attacks aren’t going away.

According to the Anti-Phishing Working Group, there were 1,974 unique phishing attacks in July, the latest month for which data are available; financial services companies averaged 53 unique attacks each day.

The number of overall attacks — including those on retail, Internet, governments and other operations — grows by an average of 50 percent each month, according to the group, a year-old organization with more than 200 members, including businesses, software developers and law-enforcement agencies.

Consumers should be wary of any e-mail asking for personal information, especially when it comes to money, said Whitney Watson, a spokesman for Kansas Atty. Gen. Phill Kline. Such e-mails often come from overseas scammers, who copy corporate logos to add legitimacy and set up temporary hyperlinks that last only a day or two — just enough to snag victims, but short enough to elude authorities.

No bank is immune to the scams, he said, which have expanded into major retailers including Amazon.com and others.

“I got one today from someone claiming to be Suntrust Bank,” Watson said. “They happen all the time, because people still fall for them, unfortunately. The scammers wouldn’t be doing this if it wasn’t working.”

Elisa Zahn, a Kansas University senior from Littleton, Colo., fell into the trap. Earlier this month she answered an e-mail from “Commerce Bank,” warning her that her accounts had been accessed while she had been traveling the previous week.

Zahn, who had been in New York, hurriedly clicked away and followed the hyperlink to a site where she could confirm her debit card number, PIN number, online account information and online password.

“I don’t know how it could look more legit,” she said. “I ate it up, hook, line and sinker.”

Within a day more than $700 was missing from her account, through multiple withdrawals from ATMs in Tallahassee, Fla.

Commerce covered the losses, Zahn said, but she’s been working the phones since then — to the bank to close old accounts and open new ones, to national credit bureaus to report the fraud and flag her Social Security number for theft, to the police in Florida to track down the perpetrators.

“It’s a pain in the butt,” she said. “I got all my money back and that’s fine, but this whole last week has been hectic. I’ve definitely learned my lesson.”

On Sunday she received another e-mail from “Commerce Bank” — the one asking her to “safeguard” her accounts from “identity theft.”

She hit delete.

J-W Staff ReportsThe Kansas Attorney General’s Office offers these tips for eluding e-mail scams:¢ Never provide your Social Security number, birth date, credit-card or bank account numbers, or any personal or financial information in a response to an e-mail.¢ If you receive an e-mail asking for personal information, do not click on hyperlinks; they may take you to a site that only resembles the one you intended to visit. Use your browser to enter the company’s Web address or call the company directly.¢ If you have any suspicions about correspondence requesting personal information, contact the company and ask if it sent the request you received.¢ Once a year, request your credit reports from the three major credit-reporting agencies: Equifax, Experian and Transunion.