Government Technology

    Digital Communities
    Industry Members

  • Click sponsor logos for whitepapers, case studies, and best practices.
  • McAfee

Phishing for Passwords



April 3, 2009 By

Used with permission from the Maine Office of Information Technology

This month's security item is an e-mail that was sent to us by a Maine OIT employee. The employee gave permission to reprint the e-mail, but ask that we not reveal the identity of the contributor. This is a true story of something that happened to a Maine citizen, an IT professional, and someone who knew the basic security principles of password protection. It serves as a good lesson for us all that no matter how careful we think we are being, it only takes one small mistake for things to unravel quickly.

Our co-worker's story:

"I think that a lot of people don't take it serious when they are told to use a different password for everything and people like me assume they are really careful and nothing will happen to them."

Often times in my hotmail account I get a "phishing" e-mail that contains a fake PayPal link and since I know better I simply hit forward and send it on to the PayPal security team. On March 9, 2009 I received one, and because I haven't used PayPal since September of last year I didn't read it and just forwarded it to them. On March 10, 2009 I received an e-mail from PayPal stating my account had been changed to limited access in the subject line so I read it and it was limited because they believed a third party had accessed my account. They didn't state in the e-mail that there had been any transactions so I shrugged it off and figured I'd log into my PayPal and cancel the account as I don't use it anymore. To my surprise when I logged in there was a transaction there for over 400 GBP which translated into $645.59 USD. In addition, the hacker had changed my address to an address in Lithuania. I then logged into my bank account and the money was gone. I obviously was very upset as I am a single income supporting my family and things are tight (as they are for everyone). I called my bank and filed a claim and called PayPal and did the same thing.

I've since received credit from my bank though the claim is still open but I know that it will be resolved in another week once the investigation is complete. We have figured out this happened because when I recently changed my hotmail password I apparently used the same password I had for PayPal. At the time I didn't even think about it because I hadn't used PayPal for so long. When either I or my fiancé accessed the e-mail from some place other than home, the hotmail account was jeopardized by either key-logging or some other method. They then tried the password for all the accounts I had listed in a folder in my email and gained access. Since this incident I have changed passwords for everything and kept them each unique. I honestly believed that as careful as I am this would never happen to me but it did. Aside from the stress and dealing with getting it cleared up (affidavits, countless long phone calls, new bank account, checks, debit cards, new e-mail address, notifying all accounts of new e-mail, etc.) the whole situation leaves one feeling very violated. It is not something I want to experience again.

Change passwords often, keep them each unique. Always monitor your accounts! Be very cautious about where you are accessing e-mail and financial accounts from. Computers with public access are a high risk.

"I hope this helps someone!"


| More

Comments

Anonymous    |    Commented April 14, 2009

The very same thing happen to me

Anonymous    |    Commented April 14, 2009

The very same thing happen to me

Anonymous    |    Commented April 14, 2009

The very same thing happen to me

PK1048    |    Commented April 15, 2009

This individual thought he was being careful ??? From what I have seen, the vast majority of people (IT staff or not) who think they are being careful really aren't educated or informed enough to behave in a truly careful manner. Unsafe actions taken: 1) Access a Hotmail (or any other) email account from a public terminal. Public Internet terminals are not to be trusted. 2) Using the same password for a FINANCE account and *any* other account. I use the same password for a number of online accounts, but I really don't care if my Newegg account is cracked, there is no credit card, PayPal, or any financial information tired to it. 3) Associating a PayPal account with a bank account with more than a trivial (or sufficient for your Pay Pal transactions) amount of money in it. Maybe I'm paranoid, but the bank account tied to my PayPal account has less than $50 in it.

PK1048    |    Commented April 15, 2009

This individual thought he was being careful ??? From what I have seen, the vast majority of people (IT staff or not) who think they are being careful really aren't educated or informed enough to behave in a truly careful manner. Unsafe actions taken: 1) Access a Hotmail (or any other) email account from a public terminal. Public Internet terminals are not to be trusted. 2) Using the same password for a FINANCE account and *any* other account. I use the same password for a number of online accounts, but I really don't care if my Newegg account is cracked, there is no credit card, PayPal, or any financial information tired to it. 3) Associating a PayPal account with a bank account with more than a trivial (or sufficient for your Pay Pal transactions) amount of money in it. Maybe I'm paranoid, but the bank account tied to my PayPal account has less than $50 in it.

PK1048    |    Commented April 15, 2009

This individual thought he was being careful ??? From what I have seen, the vast majority of people (IT staff or not) who think they are being careful really aren't educated or informed enough to behave in a truly careful manner. Unsafe actions taken: 1) Access a Hotmail (or any other) email account from a public terminal. Public Internet terminals are not to be trusted. 2) Using the same password for a FINANCE account and *any* other account. I use the same password for a number of online accounts, but I really don't care if my Newegg account is cracked, there is no credit card, PayPal, or any financial information tired to it. 3) Associating a PayPal account with a bank account with more than a trivial (or sufficient for your Pay Pal transactions) amount of money in it. Maybe I'm paranoid, but the bank account tied to my PayPal account has less than $50 in it.


Add Your Comment

You are solely responsible for the content of your comments. We reserve the right to remove comments that are considered profane, vulgar, obscene, factually inaccurate, off-topic, or considered a personal attack.

In Our Library

White Papers | Exclusives Reports | Webinar Archives | Best Practices and Case Studies
Digital Cities & Counties Survey: Best Practices Quick Reference Guide
This Best Practices Quick Reference Guide is a compilation of examples from the 2013 Digital Cities and Counties Surveys showcasing the innovative ways local governments are using technological tools to respond to the needs of their communities. It is our hope that by calling attention to just a few examples from cities and counties of all sizes, we will encourage further collaboration and spark additional creativity in local government service delivery.
Wireless Reporting Takes Pain (& Wait) out of Voting
In Michigan and Minnesota counties, wireless voting via the AT&T network has brought speed, efficiency and accuracy to elections - another illustration of how mobility and machine-to-machine (M2M) technology help governments to bring superior services and communication to constituents.
Why Would a City Proclaim Their Data “Open by Default?”
The City of Palo Alto, California, a 2013 Center for Digital Government Digital City Survey winner, has officially proclaimed “open” to be the default setting for all city data. Are they courageous or crazy?
View All