T2W Trading Community

Spoof Websites

Also known as "phishing", these will typically appear in your inbox, prompting you to visit a site purporting to be owned by your bank, or Ebay, or Paypal, to tell you that they are "updating their records, and could you please log in to verify them" - or some such. Of course, you click on the link provided in the email, which takes you to the site that it is alleged to come from. You log in, put in your details, and maybe think no more of it. But there's a problem.

Lets say that the site you get the email from is PayPal, Ebay's payment method. Or at least you think its PayPal. But its not - I promise you.

What it is, in fact, is a copy of the PayPal site. This is relatively easy to do. You could copy the entire page of this website, for example, by viewing the source code, and placing it on another site somewhere else. It would look the same, sure - but it won't function the same because the content that creates this page and a lot of web pages is dynamic - pulled from a remote database - and wouldn't be there. But you get the point - it is simple enough to copy an entire website and fool people into thinking that its the real thing. So, you go along, think you've logged in - but what you've actually done is send your username, password and who knows what else to a database elsewhere, for someone to retrieve at leisure, log in to your accounts, and clean them out.

There are a couple of things we can do to stop this.

First of all, when you visit a site such as PayPal, Ebay or maybe your online bank, just check the actual HTTP header in the browser. Make sure that the address is correct. For example, for Ebay it should say something like : http://www.ebay.co.uk/. If it says anything different, manually type the address into the browser or take it from your "favourites" list and use that. Don't click the link they they send you and think that it is OK just because it looks right. It can say one thing and mean something else.

Another thing to check for is the encryption. All sites such as those mentioned above use a technology called SSL (Secure Sockets Layer) and 128-bit encryption to protect your identity. Hence, when you go to log in at, for example, Ebay, you should see something like: https://signin.ebay.co.uk/ws/...... Note the trailing "s" after HTTP. This denotes that it is a secure web page. As does the small padlock symbol that all browsers should display in the bottom right-hand corner. Without all of these, don't even try to log in, because you're not where you think you are. If you aren't familiar with this, try the following:

Open a web browser, and type "http://www.paypal.com" into the address line. After a few seconds, the site will come up. However, you'll note that the address you typed in has changed to "https://www.paypal.com", and the padlock symbol should display in the corner of the browser. This is what you need to look for to make sure you're on the site you think you are, and not somewhere else.

Some browsers, such as Mozilla, offer add-on extensions (in Mozilla's case called "spoofstick") that will automatically tell you the correct address of a website, regardless of what it displayed in the actual address bar.

A lot of sites that have either been phished or may be subject to phishing will often send genuine emails to their customers saying that they will never ask you to log in and verify your details. Trust them. If you follow the simple points laid out above, you can establish very quickly whether you are on the genuine item or a good copy.