August 27, 2003

[Clarification: To my knowledge, www.mynewcard.com is a legitimate Bank of America website. -- DS, 2/5/2004]

Speaking of I'm-your-bank scams: Scams even smart people fall for. (Thanks Rebecca.)

A lot of people have gotten an e-mail in the past week that looks deceptively like it's from Citibank, complete with logo and dry bank-speak asking you to review the bank's new Terms and Conditions by clicking on the link and indicating your agreement with the new policy. Otherwise, the e-mail informs you, the bank will have to suspend your checking account.

Don't click on the link. And if you do, don't reply to the questions. Con artists interested in identity theft are "phishing" -- that is, stealing company logos to make e-mails requesting personal information look official. Once they get your information, they can wreak havoc in your financial life.

Citibank is just one among many companies that have been the target of phishers. Others include Best Buy, eBay and Bank of America.

Now tell me how I could possibly tell the difference between an official B of A mailing using "mynewcard.com" and an outright scam.

comments...

Charlene, January 28, 2004 2:03 AM:

Thank you Rebecca,



I almost fell for the scam from Bank of America.. so glad I read what was on line thanks again

Guy, February 4, 2004 6:33 AM:

I got a pre-approved offer in mail from B of America directing me to go to www.mynewcard.com?



Is that site offical or is it a scam?

Dan Sanderson, February 4, 2004 6:40 AM:

mynewcard.com is an official Bank Of America website. I got confirmation of this from BofA's customer service representatives. I apologize if I gave any other impression.



My point was that email users do not have enough information to distinguish between email advertisements and "phishing" scams that pose as representing a legitimate institution, such as a bank, and therefore such institutions should carefully consider how they use email (and the web) to promote their services. I propose that legitimate institutions should *never* use email for promotion and should encourage their users to never trust email that looks like it comes from them.