What is Phishing?

'Phishing' is a common type of Internet piracy. It is deployed to steal user’s personal and confidential information like net banking Login IDs, passwords, bank account numbers, credit card /Debit Card numbers, personal identity details etc. Later the perpetrators may use this information for siphoning money from the victim's account or run up bills on victim's credit cards. In the worst case one could also become the victim of identity theft. We would like you to be aware of methodologies in a 'Phishing' attack, do's and don'ts in sharing of personal information and the action to be taken in case you fall prey to a phishing attempt.

Methodologies

• Phishing attacks use both social engineering and technical trick to steal customers' personal identity data and financial account credentials.
• Customer receives a fraudulent e-mail apparently from a legitimate Internet address.
• The email invites the customer to click on a hyperlink provided in the mail.
• Click on the hyperlink directs the customer to a fake web site that looks similar to the genuine site.
• Usually the email will either promise a reward on compliance or warn of an impending penalty on a non-compliance.
• Customer is asked to update his personal information, such as passwords and credit card and bank account numbers etc.
• Customer provides personal details in good faith. Clicks on 'submit' button.
• He gets an error page.
• Customer falls prey to the phishing attempt.

Dont's

1. Do not click on any link which has come through e-mail from an unexpected source. It may contain malicious code or could be an attempt to 'Phish'.
2. Do not provide any information on a page which might have come up as a pop-up window.
3. Never provide your password over the phone or in response to an unsolicited request over e-mail.
4. Always remember that information like password, PIN, TPIN, etc are strictly confidential and are not known even to employees/service personnel of the Bank. You should therefore, never disclose such information even if asked for.

Do's

1. Always logon to a site by typing the proper URL in the address bar.
2. Give your user id and password only at the authenticated login page.
3. Before providing your user id and password please ensure that the URL of the login page starts with the text ‘https://’ and is not ‘http:// ‘.The 's' stands for 'secured' and indicates that the Web page uses encryption.
4. Please also look for the lock sign at the right bottom of the browser and also Verisign certificate.
5. Provide your personal details over phone/Internet only if you have initiated a call or session and the counterpart has been duly authenticated by you.