Yahoo!7 and Insafe have joined forces on Safer Internet Day to highlight ways to stay safe online when gaming or using social networking – have a look:

• Think before you post. How you represent yourself online — the way you play games, the photos and texts you share, the design of your avatar, and what you have on your profile – all add up to who you are. Invest in your online image.
• Be a good sport. Virtual games can be fun, but remember to treat other players with respect. If you wouldn’t do it on the field, don’t do it online either.
• Take action and report bullying. If you stand by and watch, laugh, or do nothing when you see bullying happen, you become part of the problem. Take the opportunity to create positive change.
• Spread smiles with your phone. Texting is core to staying connected with your friends. What you text is a reflection of you, so be thoughtful about what you say so you can be confident that your texts portray you the right way.

Did you know that Yahoo!7 works collaboratively with industry peers, child safety groups, government and law enforcement to find new ways to protect children online? Yahoo!7 is a very proud partner to the Cooperative Research Centre for Young People, Technology and Wellbeing led by the Inspire Foundation. Yahoo!7 also supports the work of several non-profit Internet safety organisations including the Safer Internet Group, Alannah and Madeline Foundation, Bravehearts, Common Sense Media, Family Online Safety Institute, Internet Keep Safe Coalition, and the US National Centre for Missing and Exploited Children, as well as efforts from governmental groups such as the Australian Communications and Media Authority.

“Online safety has long been a priority for Yahoo!7 and we are proud to celebrate Safer Internet Day with our Yahoo!7 Safely site in Australia,” said Samantha Yorke, Legal Director for Yahoo!7.   “With Yahoo!7 Safely, we are giving children, teens, and parents the tools they need to make smart digital decisions and to deal with the important online issues they face every day. It’s important that we take a proactive approach and work together as a global community to help foster a safer online experience for all children.”

• Always be cautious when accessing your account when using unsecure Wi-Fi networks. Consider accessing your account only on networks that use WPA-enabled secure Wi-Fi connections. And, you should only connect to Websites that use cookie-based authentication.
• Sign up for a personal VPN service and use it when you connect to a public Wi-Fi network. If you’re using a work computer that has VPN software, activate it.

I will try to provide more practical info about online scams here. In return, please, please, please be sure to share this post with everyone you consider at risk of falling victim to one of the many scams around. And there are so many people at risk…  According to the NSW Fair Trading website “every year 1 in 20 Aussies fall victim to scams.”

“Scams target everyone regardless of background, age and income and they come in many forms and reach you in many ways – by mail, online through e-mail, telephone and door-to-door. Scams are often designed to trick you into giving away your money or your personal details. Scams succeed because they look like the real thing. Scammers are manipulative – they push the right buttons to produce the response they want.”

The Australian Competition and Consumer Commission run the SCAMwatch website, which provides information to consumers and small businesses about how to recognise, avoid and report scams.  One common type of online scam is called ‘requests for your account information’ or ‘phishing scams’.

“Phishing refers to emails that trick people into giving out their personal and banking information; they can also be sent by SMS. These messages seem to come from legitimate businesses, normally banks or other financial institutions or telecommunications providers. The scammers are generally trying to get information like your bank account numbers, passwords and credit card numbers, which they will then use to steal your money. Phishing emails often look genuine and use what look to be genuine internet addresses—in fact, they often copy an institution’s logo and message format, which is very easy to do. It is also common for phishing messages to contain links to websites that are convincing fakes of real companies’ home pages. The website that the scammer’s email links to will have an address (URL) that is similar to but not the same as a real bank’s or financial institution’s site. For example, if the genuine site is at ‘www.realbank.com.au’, the scammer may use an address like ‘www.realbank.com.au.log107.biz’ or ‘www.phoneybank.com/realbank.com.au/login’.”

The following information was extracted from the SCAMWatch site:

Warning signs

• You receive an email or SMS claiming to be from a financial institution, telecommunication or email provider. This message may seem to be from your bank, service or email provider or a business you don’t have an account with. The email contains a link that leads you to a website where you are prompted to enter your bank account details or email account details.
• The email does not address you by your proper name.
• The email might contain typing errors and grammatical mistakes.
• The email might claim that your details are needed for a security and maintenance upgrade, to ‘verify’ your account or to protect you from a fraud threat. The email might even state that you are due to receive a refund for a bill or other fee that it claims you have been charged.

Protect yourself from phishing scams

• NEVER send money or give credit card or online account details to anyone you do not know and trust.
• Do not give out your personal, credit card or online account details over the phone unless you made the call and know that the phone number came from a trusted source.
• Do not open suspicious or unsolicited emails (spam)—ignore them. You can report spam to Australian Communications and Media Authority. If you do not wish to report the message, delete it.
• Do not click on any links in a spam email or open any files attached to them.
• Never call a telephone number that you see in a spam email or SMS.
• If you want to access an internet account website, use a bookmarked link or type the address in yourself—NEVER follow a link in an email.
• Check the website address carefully. Scammers often set up fake websites with very similar addresses.
• Never enter your personal, credit card or online account information on a website if you are not certain it is genuine.
• Never send your personal, credit card or online account details through an email.

As well as following these specific tips, find out how to protect yourself from all sorts of other scams. Download our Phishing scams fact sheet for more information.

Do your homework

If you receive an email claiming to be from a bank, other financial institution, telecommunications or email provider that asks you to enter your details—delete it! A legitimate bank or financial institution will NEVER send an email like this.

If the email appears to be from your bank or financial institution and you think it might be genuine, telephone your bank or financial institution to let them know about the email and ask their advice. DO NOT call any telephone number listed in the email; instead, use a phone number that appears on your bank statement or card or in the telephone directory. Many banks and financial institutions now have specialised internet security staff that can help you.

Decide

You should NEVER give your personal or bank account details to people you don’t know and trust. Don’t be fooled by an email that looks legitimate or appears to link to a genuine website. If you think the email may be genuine, ALWAYS contact your bank to confirm an email’s legitimacy before replying. Your best defence is to delete the email straight away.

For me, this paragraph summarises everything:

“My top advice is to be mindful of any Web page that requests your Yahoo! password. The #1 way people get their passwords stolen is by typing them into lookalike “phishing” web sites, pages that pretend to be Yahoo! or another trusted Web site but actually are run by the bad guys. Scrutinise carefully any page that requests your Yahoo! password.” – Mark Risher, Director of Product Management for Mail.

For more tips and information on how to keep yourself and your computer safe online, check this post on our Yahoo!7 Answers Blog.

If you’ve reached this post and you’ve already fallen victim to a phishing scam with your Yahoo!7 Mail account, read this post to find out what to do next.

Finally, please report any suspicious emails to Yahoo!7 Customer Care via this form.

Cheers,
Tasla – Yahoo!7 Mail Team

Keeping you safe while you’re online is a top priority for us here at Yahoo!. One important part of your online safety is making sure that nobody else can access your Yahoo! Mail account without your permission, and the best way to do that is to make sure you choose a good password and make sure nobody else knows it or can easily guess it.

know it can feel like a pain typing out a more detailed password, but none of us want to make it any easier for the bad guys.

My top advice is to be mindful of any Web page that requests your Yahoo! password. The #1 way people get their passwords stolen is by typing them into lookalike “phishing” web sites, pages that pretend to be Yahoo! or another trusted Web site but actually are run by the bad guys. Scrutinize carefully any page that requests your Yahoo! password. In addition:

• Make sure the Web page address doesn’t have any misspellings or extra words (e.g. http://www.yah000.com, http://www.yahoo-members.com, or http://www.yahoo.BadGuyEnterprises.com) in it. When it doubt, go straight to http://www.yahoo.com.au and log in from there.
• Be vigilant about anything that doesn’t look right on the page, such as typos, outdated content, or broken or missing pictures.
• Best idea: be sure to set up a customized “Sign-In seal” picture — instructions are located here — and never enter your password unless you see that picture on the page.

Here are a few more tips to help keep you safe online:

• Don’t use the same password on multiple sites. Your Yahoo! Mail account is important to you, so it deserves its own password. That way, if the unthinkable happens on another site, at least your Yahoo! mailbox remains secure.
• Never send your password over email. Yahoo! will never request your password from you in an e-mail; if you ever receive such a request, you should treat it as fraud. Do not pass “Go!” Instead immediately click the “Spam” button on that message.
• Protect yourself with a virus scanner. Another way passwords get stolen is from a virus that records your keystrokes. Don’t give the bad guys that option: There are a number of anti-virus companies that offer free versions or trial offers, including (in no particular order and with no specific endorsement implied) http://security.symantec.com , http://usa.kaspersky.com/downloads/free-virus-scanner.php, http://us.mcafee.com/root/downloads.asp?id=freeTrials, and http://www.avast.com/eng/avast_4_home.html.

Unfortunately there is no silver bullet against these criminals and con-men, but hopefully these tips will help us all keep the bad guys at bay.

Mark Risher – Spam Czar, Yahoo! Mail

You may have heard or read about email accounts and their passwords being posted online. While I’ve read different versions of how the person(s) responsible was able to get the email account information, it was not a result of any insecurity at Yahoo! It looks to be a result of phishing attacks. Should you feel that one of your email accounts was affected by the recent publication, whether it is a Yahoo!, Hotmail or Gmail account, I would suggest changing your password as well as other account security information like secret questions and alternate email addresses.

We are aware that a limited number of Yahoo! IDs have been made public, it’s uncertain if any of those email/password combinations have resulted in any accounts being compromised. Online scams and phishing attacks are an ongoing and industry-wide issue and Yahoo! takes great effort to protect our users’ security.

We also have the following online resources that provide information and guidelines on email safety:
Our anti-spam site: http://au.antispam.yahoo.com/
With a phishing prevention sub-section: http://au.antispam.yahoo.com/phishing/
Our help pages: http://help.yahoo.com/l/au/yahoo7/mail/yahoomail/abuse/
And of course, I’ve posted a number of articles about online safety to this blog: Spotting phishing emails, how to spot online scams, avoiding the lottery scams, and account recovery help

Here are a couple FAQs that provide additional information:
Have accounts been compromised because of this?
We are unable to confirm whether accounts have been compromised at this time. However, we strongly suggest that consumers take caution in securing their email and other online accounts by regularly changing their passwords, and updating account security information.

What do I do if I think my account has been compromised?
You should change your password immediately. Also, if you are unable to enter your account, you can take steps to recover it here: https://edit.yahoo.com/forgotroot

We take online security seriously at Yahoo! We strive to make you and your Yahoo! account as safe as possible. Of course if you have any questions or issues with your account, please contact our Customer Care team.

Please rest assured that Yahoo!7 will never email you asking for your password. If you receive such an email that looks like it’s from us, please be sure to pass it on via this form.

The following blog posts, that we have previously written on different security issues, may also be of interest to you:

• Tips for Spotting Online Scams
• Be Wary of Supposed Lottery Wins
• Log in securely with Sign-In Seals
• We will never ask for your password

Email safely,
Kate – Yahoo!7 Mail Team

You’ve all probably seen some sort of scam email, and by now you probably think you’ll never be fooled by one. But from time to time, I get one that I think is particularly cunning. And it reminds me that it’s never a bad thing to have a little refresher course on how to avoid be the victim of phishing scams. I received this email over the weekend, and thought I’d share it with you as a particularly good example of a phishing email.

Phishing, for those of you unfamiliar with the term, is the act of trying to trick you into revealing your account and login information via a fake email or fake Website. The one pictured above is a prime example of a phishing email, which uses a scare tactic to try to solicit you to send your account details and password. Here I’m being asked for the password for my Yahoo! account, and the email threatens that I could lose my account if I don’t send my info. It could just as easily been my banking information.

The most important thing you need to know is that we will never ask you for your password. NEVER!! And we would certainly never ask you to give us any of your account information unsolicited. Banking sites, like Yahoo!, are the same and you will never be asked for your account details in an email.

So if you receive an email like the one above, don’t fall for it. Just delete it, or better yet, report it using this form.

So there you have it, Yahoo!7 will never email you asking for your password!

If you receive such an email that looks like it’s from us, please be sure to pass it on via this form.

The following blog posts may also be of interest to you:

• Tips for Spotting Online Scams
• Be Wary of Supposed Lottery Wins
• Log in securely with Sign-In Seals

Email safely,
Kate – Yahoo!7 Mail Team

When signing in to Yahoo!7, you will no doubt be familiar with the yellow box directly above where you input your login details. This is the Sign-In Seal.

To start the creation process, simply click upon the key symbol or upon the “Create your sign-in seal” link, as demonstrated above. The entire process will only take a minute or so of your time, well worth it for peace of mind!

Once you have elected to create a sign-in seal, you are presented with two options:

• Create a text seal
• Upload an image

Creating a text seal
To create a text seal, simply select the “Create a text seal” option.

You will then be shown 3 text boxes in which to input your message, you may fit more than one word per box, as we have shown in the example. In total, your message may not exceed 21 characters. It is not recommended that the message be either your Yahoo! id or your password; instead perhaps choose your address, names of your family members or pets, a favourite artist or saying. The important thing is – choose something that you will remember and know instantly that you are signing in securely.

Clicking the preview option will give you a view of how your seal will appear, clicking save will return you to the sign in screen and your seal will appear ready for use.

Creating an image seal
To create an image seal, simply select the “Upload an image” option.

You will then be shown a box, with a browse option from which to navigate your computer and select your image of choice. You may wish to use a photo of a family member or favourite pet, or something else entirely; the choice is up to you. The important thing is to choose something that is instantly recognisable to you.

As with the text seal creation, clicking the preview option will give you a view of how your seal will appear and clicking save will return you to the sign in screen; and your seal will appear ready for use.

Sign-in seal colour
To further customise your sign-in seal, you have the option to choose from a range of colours. As seen in the examples previously shown, you can see the use of purple in the image border and the text seal background.

If you are interested in reading further about Sign-In Seals, check out our FAQ page.

So what are you waiting for? Why not spend a few moments to create your sign-in seal and relax!

Happy creating,
Kate – Yahoo!7 Mail Team

It is currently Scams Awareness Month in the UK, so we bring you this post from Andrew of the Yahoo! Mail Team who handles both the UK and US Mail Blogs:

This month in the UK, the Office of Fair Trade is promoting their annual Scams Awareness Month. In support of their efforts, I’ve posted some scam avoidance tips on the UK Mail Blog. Since they apply just as much across the pond as they do State-side, I wanted to share them with you too. The first step in helping you to stay scam-free is to recognize the types of scams that are out there. Here are the three most common types that come in email form (which I’m sure some of you have seen before):

1. Phishing scams – These are email scams that claim to be from an organization, like a bank, and they ask you click on a link which takes you to a Website that looks real but is, in fact, fake. When you log in with your account details and password on this fake site, the bad guys gain access to your private information.
2. Lottery Scams – These are emails that tell you have won a local or foreign lottery and to get the money you have to pay processing fees and send personal details.
3. Advance fee or fund transfer schemes – These are also called Nigerian ‘419’ scams where you receive an email, often times from someone claiming to be in Africa or Asia, and claiming that they have access to huge sums of cash but need your help getting it out of the country. In this scam, the criminal offers to send you a check for $100,000 and you send him back a personal check for $90,000 and keep the difference. The scam is, of course, that the initial check is bogus but may take several weeks to clear, by which point the criminal is long gone with your money.

You know what? Your bank will NEVER ask you for a password in an email, you have NOT won the lottery and all you end up with for those huge sums is a ZERO balance in your bank account.

Still not sure if an email is really a scam? In collaboration with Mark our Anti-Spam Czar, Andrew has also posted some excellent tips on how to identify scam emails along with some examples of what they may look like. Head on over to the Yahoo! UK Mail Blog to read more

The most important piece of advice we can give you is, never act upon anything in these sorts of emails and never reply to them.  If you should ever receive such an email, please be sure to pass it on to us via this form.

Happy Identifying,
Kate – Yahoo!7 Mail Team

Our resident Anti-Spam Czar, Mark Risher, recently had a few words to share about lottery scams in this Yodel post:

Coalition crackdown on lottery spammers

What generally increases when the overall economy declines? That’s right – crime. And these days, when you receive an email that proclaims that you’ve won the “Yahoo! Lottery,” the financially-pressured optimist in you might be more inclined to bite the bait.

Last May, we filed a lawsuit against “Yahoo! Lottery” spammers who use our brand to trick unsuspecting users into handing over personal data to claim a prize. And we’re making progress on catching these scammers, but we’re concerned that they may step up efforts to dupe people impacted by these tough times.

Today we announced a public-private coalition with Microsoft, the African Development Bank, and Western Union to allow victims of lottery scams to upload police reports we can use with the goal of tracking down these devious criminals and developing better ways of protecting people online. INTERPOL has gotten involved to inform international law enforcement agencies about the initiative and provide guidance on critical information to collect to identify trends and common patterns.

Here’s how it works. Yahoo! and the other coalition members have set up dedicated email addresses and Web sites (ours is http://antispam.yahoo.com/phishingtips) where lottery scam victims — those who took the bait and handed over personal information — can share details of the police report they have filed. These reports may be helpful to other coalition members and law enforcement in fighting lottery scammers.

For readers who spot a scam but don’t fall for it, we have tips for you, too. First off, don’t ever reply to the message, even as a joke. You don’t want to be encouraging these guys. Instead, click the “Spam” button, which helps us and our anti-spam systems block these types of messages and kick these criminals off the Internet. We also have a form you can use to report lottery scams and other kinds of abuse originating from Yahoo! users.

As we’ve said before, no one ever wins the Yahoo! Lottery. And that’s simply because there is no Yahoo! Lottery. We’re on a mission to protect you from these online predators, but in addition to what we’re doing on our end, you can also find some tips on how you can protect yourself on our anti-spam resource site.

Mark Risher
Anti-Spam Czar, Yahoo! Mail

Wow! What excellent news from Mark!

Should you ever be “lucky” enough to receive such an email, please do not reply to it and be sure to pass it on to us via this form.

Email safely,
Kate – Yahoo!7 Mail Team