Chris Sells
Marquee de Sells: Chris's insight outlet
September 30, 2005 spout

I need Outlook’s new anti-phishing support

Forget that my family constantly asks me things like “I got an email from eBay today that said my account was closed. Should I click on the link and give them my credit card details?” Forget that I’m constantly having to watch every single link I touch. No, I need Outlook’s new anti-phising protection because with all my computer education and experience, I got bit by an phishing attack.

In my defense, it was the perfect storm opportunity:

  • We’ve just moved and I’m still dealing with a ton of change of address issues
  • I ordered several books from Amazon in the old house that hadn’t been delivered before we moved
  • I had just placed an order that morning on Amazon that morning w/o my caching settings, forgetting to update my credit card billing info

So, when the Amazon email came in telling me that there were problems with my account, I didn’t hover my mouse over the link before clicking it. When the page came up, looking just like an Amazon page, including the bit where they strip away most of the options when you’re entering payment information, no alarms went off. Even when they asked me for my PIN, which I don’t use for my credit card, so I don’t know it, I entered everything else, e.g. login ID, password, credit card, expiration and even that extra code they stick on the back these days and pressed Submit before I thought anything might be amiss. It was when they complained about the lack of PIN and sent me back to the same page to enter it that, too late, I thought to question this site.

Of course, I canceled that credit card right away and began changing all of the sites where I use that same user name/password combination (most, frankly). But still, it put a kink in my day (and I honestly don’t know all of the sites where I use that user name/password combo).

And so, while I’m installing Office 2003 SP2 as we speak, I have to wonder: why is it that anyone can send an email claiming to be whoever they want? Isn’t that a problem worth disrupting the world a bit to fix? I think it is.