Spam Gets DangerousSpam Gets Dangerous

A major anti-spam vendor is warning companies to take precautions against an emerging form of spam designed to take advantage of unsuspecting users.

SurfControl plc execs say "brand spoofing," in which a spammer disguises E-mail to make it appear as if it's from a trusted company in order to extract personal information such as account details and Social Security numbers, is a growing and dangerous form of spam. Among the companies that have been brand spoofed in recent months are Best Buy, UPS, Bank of America, PayPal and First Union Bank, according to SurfControl.

Sony Electronics last week warned that it had become aware of a deceptive mass E-mailing that was sent to consumers with the subject "Sonystyle user and email address." The message, which claimed to come from "SonyStyle Customer Service," requested personal information, including user names and passwords.

Michael Osterman, principal analyst with messaging research firm Osterman Research, says brand spoofing is a newer form of E-mail spoofing, in which spammers disguise E-mails to look like they come from familiar addresses, such as those of co-workers. Osterman thinks brand spoofing is most threatening to consumers who don't get a lot of E-mail and thus might be easily fooled, but he also expects it could endanger small businesses where the recipient is more likely to be a decision-maker.

SurfControl advises companies to take a few precautionary steps to protect their IT systems, employees, and customers:

• Notify customers and employees that E-mails seeking personal information are suspicious and should be reported immediately. There's no legitimate reason for any Web site to ask for E-mail verification or an update of confidential information via E-mail.

• Urge customers and employees not to open suspicious E-mails or even visit Web sites mentioned, as they pose a risk, such as the possible automatic download of a Trojan horse program, to anyone logging on to the site.

• Monitor Internet and spam security information resources.