Beware of Phishing Scams on Social Networks

There's a new phishing scam making the rounds at Twitter, Facebook, and other social networking sites.

Phishing (as in "fishing", get it?) is a form of identity theft where the scammers try to get you to reveal private information -- usernames, passwords, account numbers, etc. -- by posing as a legitimate entity.

These latest phishing scams entice you to click on a link with a message that goes something like, "hey! check out this funny blog about you..." When you click on the link to the website, it will look like the login page for a legitimate website (say, Twitter), and asks you for your username and password. The end result is the scammer hijacks your Twitter account.

SmallBizResource.com describes a phishing scam using the same hook, but targeting Facebook users:

A Facebook member (let's say you) receives a message that appears to come from a friend and tells you how amazing you look in a new video. To see that video, you're told to click on a link, which sneakily whisks you away to a compromised site that tricks you into updating your Flash software. Your attempt at an honest update enables an executable file that installs the Koobface worm, which installs a proxy server that redirects Web searches and enables ad hijacking and click fraud.

While the end result of the Twitter and Facebook phishing scams do different things -- one hijacks your Twitter account, one downloads malicious software to your computer -- the initial hook is similar. They both send you a message from a "friend", claiming to have seen a photo or video of you. This hook is especially effective because it piques victims' curiosity (who wouldn't want to see videos of themselves?) while preying on their trust of social networking "friends".

To protect yourself from this and other phishing scams, check out our definition of "phishing" that also has tips for not becoming a victim.