How Does Phishing Work?

With all the worry about online identity theft, people are more concerned than ever about protecting their personal information and avoiding attacks or scams designed to gain that precious information. Online identity theft involves a complex range of vocabulary and ideas, and one of the most common questions people ask when researching Internet identity theft is: what is phishing?

What is phishing?
Phishing is exactly what it sounds like: criminals using the Internet to -fish' for sensitive personal information, such as usernames, passwords, bank account or credit card information. The most common method of phishing involves criminals sending email messages to unsuspecting users, claiming to belong to a financial institution or popular online entity and asking for information verification.

How does phishing work?
Phishing emails typically direct users to click a link to a website that claims to be a well-known online entity or financial institution. When unsuspecting users click the link, they're taken to a website that typically looks like the regular organizational website, complete with logos and institutional color schemes. The link leads to a form that requests personal information from users, including username, password, full name, address, date of birth, phone number, social security number and bank account or credit card information.

What happens to the personal information?
Once you enter personal information into the form and submit it, that information goes directly into a database of personal information maintained by online identity thieves. One of three things happens to the information once online identity thieves get it: they use it to make purchases, they use it to set up new accounts in your name, or they sell it.

Phishing as a form of organized crime.
Identity thieves sometimes use your personal information to order items online, make hotel and travel reservations or otherwise run up charges in your name. Professional rings of identity thieves often order items online using stolen personal information, have the items sent to a third-party who is unaware that theft is occurring, and arrange for the items to be picked up and resold for profit. Sometimes, identity thieves simply transfer your funds to dummy accounts, which they then use to pass the funds along for their use.

Personal information has resale value.
When phishing criminals don't have a ring in place to receive and resell merchandise purchased with stolen information, they may simply resale your personal information to other criminals. Some criminals gather information with phishing emails, and then go into chat rooms to sell the information to other criminals, who use it in the manner outlined above.

What is phishing: creating fraudulent accounts.
If a phishing email gives criminals access to only one of your accounts, the damage is limited. However, if phishing emails gather your personal information, criminals can then use it to open new accounts in your name. They enter false addresses and phone numbers, so you'll never even know charges are being made until the next time you pull your credit.