On month ago, I didn't even know "phishing" is a word; Merriam-Webster Online doesn't think it is a word either and proves I was not too ignorant. Nevertheless, we'd better know its existence now so that we can avoid becoming the next victim.

In short, phishing attacks are fake emails that appear to be from well-known companies (mostly financial institutions), ask you to go to a web site to perform certain tasks, and in the process, gain access of your confidential information like password/pin, credit card validation (CCV) code, credit card number, social security number and/or bank account number.

A typical phishing mail reads like this:

--------------------------------------

Dear Citibank Customer,

Regards, Citibank Customer Support
--------------------------------------

Pretty convincing, eh? If you click the link, you will be redirected to a perfect replica of the Citibank online banking site, and unsuspecting consumers can easily surrender account login and password.

More phishing mail examples can be found at the website of Anti-Phishing Working Group (APWG).

According to CardWeb, there are more than 1,000 phishing attacks in the month of June. These scammers reportedly succeed to persuade up to 5% recipients to respond to such emails.

So much for the information I have read, some of my personal notes on phishing:

- If an email looks like to be from Citibank, it does not mean it IS from Citibank. In the email world, anyone can fake up the sender information thanks to some shortcomings in the email protocols people invented in the early stage of the Internet. If you are not sure, always call the company to verify. Most of the time, simply ignoring the mail can do less harm than following the instructions in the mail.

- I had become victim of phishing attack once, almost. The mail appeared to come from PayPal and asks me to sign in to verify my identity due to some recent "suspicious activities." I followed the link and signed in, but I took a second look in five minutes and noticed the URL I went to does not belong to PayPal. I immediately went to the real PayPal site and changed my password.

- You might notice very few phishing mails are attacking Discover customers. Not coincidentally, the official online site of Discover Card is https://www.novusnet.com/, which does not appear to have any association with Discover. (Rest assured, I am not phishing you.) I cannot say if this is a good strategy for Discover or not; I will be a little bit confused if the real Discover asks me to go to novusnet.com for online banking.

- Many big names like Microsoft, RSA, Experian and Verisign are standing behind APWG, but I doubt we can turn off phishing attacks exclusively via technology. By the end of the day, you are the best and last defense for your identity in this online world.