Email Fraud

E-mail fraud – or “phishing” or “brand spoofing” as it is also called – uses fraudulent e-mail messages and Web sites that look like they are from a legitimate company, such as a bank, credit card company, online retailer or government agency. The e-mail you receive may look real, with company logos and branding, but beware – you may have actually received this spam or mass e-mail from a criminal. The fraudsters will cast a wide net and send the spam e-mail to thousands of people at once, whether or not they are a customer of the organization, to “phish" for personal information.

Typically, these e-mails will ask you to update or validate your personal information. There will also be some urgency to the request, warning you that if you do not comply quickly your account may be shut down. In other cases, the e-mails will promise financial benefit for the recipient if they reply, or ask for a verification of information to help protect the recipient from identity theft. By clicking on the links in the e-mail you will be taken to a phoney Web site that, again, appears to be legitimate, where you will be asked to disclose some personal information, such as your social insurance number, credit card number or online banking passwords.

How to Identify E-mail Fraud ?

So, how do you know if the e-mail you received is fraudulent? Here are a few things you should know:

• Your bank will never send you an e-mail, or call you on the phone, asking you to disclose personal information such as your credit card number, online banking password or your mother’s maiden name.
• Be suspicious of unsolicited e-mails that have a sense of urgency and warnings that your accounts will be closed or your access limited if you don’t reply.
• Does the e-mail look professional? While some fraudulent e-mails may look professional at first glance, if you look more closely you may notice spelling and grammatical errors, unusual language or branding that isn’t quite right. Fraudulent e-mails are not personalized and, instead, are addressed in general terms, such as "Dear valued customer".
• If you receive an e-mail notifying you that an e-mail money transfer is being sent from a person you don't know, delete the e-mail as it is likely fraudulent.

What Banks Are Doing to Protect You From E-mail Fraud ?

It is important to remember that fraudulent e-mails sent out by criminals may look like they come from banks, but they are not connected with banks at all. Banks, however, take extensive steps to protect your personal information entrusted to them and to help you protect it as well.

Consumer education is one of the best ways to stop e-mail fraud and prevent customers from inadvertently disclosing their personal information. Most banks have information available on their Web sites and through booklets and brochures and provide practical tips on how to protect yourself and your money.

Banks also work very closely with police to prevent fraud and criminal activity. The fraud and security teams at the banks provide support and information to police, and work closely with them to shut down e-mail fraud Web sites to protect customers from potential losses.

How to Avoid E-mail Fraud ?

In addition to bank efforts, there are some simple steps you can take to avoid becoming the victim of e-mail fraud:

• Be skeptical. Fraudulent e-mails can look like they come from a real bank e-mail address. If you have any doubts about an e-mail that looks like it is from your bank or a reputable company, contact them before responding to ensure that it is legitimate. But don’t use the toll-free number, e-mail address or Web site address provided in the e-mail: they may link you to the criminals rather than the bank. Use a phone number, e-mail address or Web site address that you know is correct.
• Never send personal and/or financial information by e-mail.
• Always enter your bank’s Web site using the Web site address (URL) that you know is accurate. Contact your local bank to get the correct Web site address if you're unsure.
• Regularly review your bank and credit card statements to ensure that all transactions are authorized. Also check your credit report at least once a year by contacting credit reporting agencies Equifax Canada or TransUnion Canada.
• Check the domain name shown as the link in the e-mail. When you click the link, if it does not match the name that appears in the browser at the top of the screen, then it may be a fraudulent Web site.
• On the Internet, whenever entering personal information, ensure that you are using a secure Web site. Look for “https://” rather than just “http://” in the address bar of your Web browser as well as a closed padlock in the bottom right corner of your browser.
• Make sure that your home computer is protected. Install anti-spam, anti-spyware and anti-virus software and make sure they are always up-to-date. You should also install a personal firewall to act as a barrier to viruses and other external attacks and check for operating system patches and upgrades on a regular basis.