A Cautionary Phish Tale

John D. Porter     2007.01.21

On Friday January 12th, 2007 I received a fraudulent "phishing" email, pretending to be from Bank of America, requesting me to confirm my account and credit card information.  This clearly looked like a scam, to me.  Hardly a news-worthy event.

In a typical week, my in-box will see several of these emails, sent by con artists to harvest sensitive personal and financial information. 

I never respond to these "phishing" emails by providing personal information.  But people
must respond to them, because this particular type of on-line con shows no sign of going out of fashion.  There must be a pay-off for criminals who concoct these schemes.

Who responds to "phishing" emails? 
How many people respond? 
What kind of information is volunteered?

Before Friday January 12th, I couldn't begin to guess. 

Then, I stumbled upon a file of harvested "phishing" data.

These web pages tell the story of how I found that file, what was in it and what I did about it.

Post Script. 2007.02.07
I followed the trail of an EBay phishing email.

I found a data file with more than 100 user names and passwords, entered by people who responded to the phishing email.

Good luck to those people, too.