Security alert! Beware of scam email from Internet fraudster Josh Phreed

I got an email from my bank recently requesting that I "upgrade security" to protect against Internet fraud. They wanted me to choose some of those daffy new "secret questions" that are replacing the old "What's your mother's maiden name?" You know the kind: What is your favourite colour? What is the name of your first pet? What dates were you circumcised - and had your appendix out? After I chose my questions the bank asked me to confirm I was me, by filling in my card number and online banking password. I was about to type them in when I got nervous.

The message was printed on the usual BMO Web page, along with their mortgage rates, security tips and corporate logo. But just to be sure I phoned my bank - and sure enough, they said it was a scam: a duplicate BMO site meant to steal my private information.

These scams are called "phishing" - computer-hacker lingo for luring "phish" close enough to grab their passwords in the Internet seas. And I'd almost become Josh Phreed.

Since then I've been invited on many such phishing trips by countless fake letters from institutions I deal with - from Caisse Desjardins to Visa and Royal Bank. Or should I say Phisa and Phoyal Bank? The letters are a far cry from those old Nigerian emails sent by supposedly deposed African princes, in fractured English. Today's letters are written in impeccable bank bureaucratese, on perfectly forged corporate sites - and they're blurring the line between cyberspace and cyber-illusion.

They raise some scary new questions: What is virtual reality and what is phirtual reality? When can we believe what we see on our computer screens? What is truth and what is phiction? If cyber-crooks can duplicate my bank and Visa sites, what can they do next? How do I know if I'm surfing on Google, or on Phoogle? On Yahoo or on Phahoo? Will they start impersonating our emails next? Can you really trust that message from your husband saying: "Hi honey - I forgot my keys. Please leave them under the mat." Can my mother believe my message asking for her killer brownie recipe? Or will she be a victim of brownie identity theft? Yet this kind of phishing is already old news. News reports warn that some sophisticated scammers can invade real corporate websites while you log in, then deflect you to a false one where you're cyber-fleeced.

To fight these scams many institutions are upping their online security so much that it's hard to get into your own accounts. It's bad enough I already have to remember 357 secret passwords to access my bank and Vidéotron accounts, or my own home phone messages. Now everyone wants me to choose more secret questions-and-answers that I won't be able to remember when I'm asked them next year.

I told one financial institution that my first pet was a poodle named Go-Go, but they rejected it because their password needs at least six letters.

So I switched it to "go goes." Or was it "gone-gone?" Or "go go go"? All I know is that I can't sign in.

Meanwhile, I'm told I should not choose secret passwords that contain real words that a hacker can crack with a computer dictionary. It's better to choose a random word like "mbxvsfxrjncz" that I can't crack either.

http://www.canada.com/montrealgazette/news/story.html?id=1f2bedac-
3c22-450c-98b1-ac34104add10