Phishing attacks

- [Instructor] Let's say you get an email like this, where it looks like it is from PayPal. It says "Response required" really big, so this is a little bit scary. And it says, "Dear," you, "We emailed you a little while ago to ask you for your help "resolving an issue with your PayPal account." This seems really serious. "Your account is still temporarily limited "because we haven't heard from you. "We noticed some unusual login activity with your account. "Please check that no one has logged into your account "without your permission." This is scary: To help us with this and to see what you can and can't do with your account until the issue is resolved, log in to your account or go to the Resolution Center. As always, if you need help or have any questions, feel free to contact us. We're always here to help. Thank you for being a PayPal customer. Sincerely, PayPal. What would you do in this situation? Well, I think for a lot of us, our emotional response is, hey, PayPal, some of my money is involved, there. They're talking about other people maybe trying to log in. I definitely wanna resolve this. And just in the heat of the moment, you might click on this "log in," or you might go to the Resolution Center, and that might start you down a little bit of a scary path. Because even though this looks like PayPal, you really need to verify that it really is PayPal. And there are some clues here that make it clear that it is not PayPal. See if you can find those. Well, the biggest clue is up here on the email address. So, it says service@intl.paypal.com as its name, but when you look at the actual email address right over here, notice it actually isn't a PayPal email address. It says @outlook.com. So, this is a pretty good clue that this is not from PayPal. And so, what is this? Well, this is known as a phishing attack. Why is it called a phishing attack? Well, I think it's probably based on the idea that when you're trying to catch fish, you dangle some bait for the fish and you see which fish are going to bite. And so, this isn't exactly fishing. They spelled the "Fuh" sound P-H because what they're really doing is they're dangling some bait in front of you and see if you're going to metaphorically get your cheek cut by the fish hook or whatever happens to fish before they get pulled out. And how would that happen metaphorically? Well, when you click on this, it probably goes to this phishy company or person's website. And that website might look like PayPal, but it's not going to be paypal.com. It's going to be some other web address. And so, one way to avoid doing that beyond looking at that this is a phishy email address is that in some browsers or in some email readers, you can scroll over this and you'll see what the website would be. Or you can right click on that. You could, say, copy the URL and you could put that in a text document to see what the actual URL is. And it's very likely that that is not going to be a PayPal URL. In fact, I would guarantee you in this case it would not be. It would look like PayPal when you get there, and what they'll probably try to get you to do is type in your username and password for your PayPal account. Why is that valuable for them? Well, you just would have then given them your username and password for your PayPal account, which then they could use to steal money from you or to do something else to you. So, be very careful where you get these urgent emails or texts. I got a text recently saying that, "Your Amazon account has been compromised. "Click here fast in order to make sure "that no more fraud happens on your account." Well, it turns out that the URL, the web address there was not amazon.com. It was going to take me to a shady website, and that shady website looked a lot like Amazon. And so, if I acted really quickly, I would've given them my Amazon username and password. So, be on the lookout for these phishing attacks, and the main way to catch them is be skeptical of anything that's talking about fraud, about something that you would scare you and say, "Hey, do I really think this is happening?" And then, if you really think it might be happening, verify the email addresses, verify the web addresses that they're really coming from who they say they're from. And it doesn't matter if the name is @somethingpaypal.com. You have to look at the actual email address and it doesn't matter what it says here. It matters what the actual URL is that it clicks to to make sure that it isn't fishy. No pun intended, or actually, that pun was intended.