A Free Educational Resource Created by Carnegie Mellon University to Empower You to Secure Your Part of Cyberspace

I was tricked by an official-looking email

Someone had stolen her username and password and sold thousands of dollars worth of non-existent goods in Ellen's name.

Ellen was a packrat, and over the decades her house had filled with all sorts of knick-knacks. After the kids left, the old house was too big for Ellen and her husband, so they moved into an apartment. Unfortunately, the apartment was too small to fit all her stuff. Instead of putting the old items in storage, Ellen decided to sell some on an online auction site and use the money for a vacation.

The site required a lot of personal information to create an account, but it was a reputable company, and the privacy policy seemed acceptable. Ellen signed up and started selling her goods. A few days later, she got an email stating that there was a problem with one of her auctions. In order to fix the problem, she had to follow a link to sign in with her username and password. The page that opened seemed legitimate, so Ellen complied.

Everything seemed OK until about a week later, when she started getting very negative feedback from buyers of items she didn't remember selling. Apparently the Web site the email had sent her to was a fake. Someone had stolen her username and password and sold thousands of dollars worth of non-existent goods in Ellen's name. Even worse, the culprit purchased items with Ellen's stored credit card information. Now Ellen is very careful about what links she follows from email messages.

To learn how to protect yourself from phishing emails, see Email - Phishing

My home page