Be Cautiously Sociable on Social Networking Sites

Innocent online chats, blogs, videos, and other interactions are like breadcrumbs that identity thieves can follow to the feast. That makes social networking sites such as MySpace and Facebook a 24-hour buffet. The thieves will keep coming back for more, as long as most Americans continue to ignore some simple precautions.

One conspicuous example is that 83% of adults who use social networking sites download unknown files to their personal computers, according to a 2006 survey of American adult Internet users. The survey, co-sponsored by the National Cyber Security Alliance (NCSA), focused on social networking behaviors that open doorways for hackers and thieves to steal identities and cause other mayhem.

Seventy-four percent of the respondents have posted personal data such as their e-mail address, name, and birthday on social networking sites. And these are adults, remember, not the stereotypical trusting teens many of us think of as the social networking demographic.

In fact, older respondents to the NCSA survey were significantly more likely than younger respondents to post their e-mail address, telephone number, and home address, while younger respondents were more likely to post only name and birth date.

Why be vigilant among "friends"?

Why do social networkers break such obvious security taboos? Perhaps it's the curious mix of familiarity and anonymity on the Web.

MySpace and the like have added a new dimension to friendship. People from across the world talk, share photos, videos, and music, and introduce one another to an exponentially growing list of real and virtual acquaintances--often using unprotected wireless devices.

Identity thieves thrive in this environment.

Any unknown file you download may contain a Trojan horse, a program disguised as something worthwhile that actually is intended to harm your computer. Some of these programs open a backdoor to your computer, through which a thief can extract key personal information such as your Social Security number, credit union and bank account numbers, passwords, and the like.

Information you share on blogs also can open doors for thieves. An example cited on the blog Identity Theft Fixes: You tell a friend on a MySpace blog that you're going on vacation for 10 days. Seems innocuous, right? But sleuths can combine that with information on your MySpace profile, such as your first name, hometown, and photo. Blog entries by people on your "friends" list also can contain clues about where you live.

In 10 minutes or less, the thief could have your address. If the thief is targeting nearby victims, he or she could have easy access to your mailbox for 10 days--a potential treasure trove of account numbers, credit card offers to activate, and more.

Welcome to phishing and pharming paradise

While studies show that most ID theft occurs when thieves get information by stealing from mailboxes or trash, be smart online. According to the NCSA survey, more than 57% of adults who use social networks received unsolicited e-mails asking for money, requesting account information, and other classic phishing ploys.

More alarming, 31% of those who received these e-mails actually responded.

Returning a phishing e-mail or clicking on a link or attachment dramatically increases the chances that the phisher will succeed, and that you'll be phished again and again.

Social networking sites also are fertile ground for "pharming," mimicking a legitimate Web site that requires users to enter personal information. For example, say you're browsing MySpace blogs and you click on a link to see someone's photos. A pop-up appears, telling you to sign in. You do it without thinking, even though you're already signed in. But the pop-up was bogus. Now an identity thief has your e-mail address--because that's your user ID--and your password.

Other pharming sites you encounter by clicking on links within social networking sites may appear to be legitimate e-tailers offering incredible deals--just enter your credit card number and ... you can guess where it ends up.

Five steps to protect your identity online

Identity theft can be devastating. Your credit score and history can be trashed for years, severely limiting your ability to get affordable credit. Stores may stop accepting your checks. You can spend hundreds of hours to set your record straight. Authorities may come after you by mistake.

In short, your financial identity is worth protecting, and you must be especially vigilant if you're active on social networking sites or posting your r�sum� online.

Start with these precautions:

Assume that everything you post on social networking sites will be visible to everyone: your family, your boss, police, college admissions staff, neighbors, predators, and thieves. And don't assume they won't know it's you--at the very least, adjust your profile so your blogs and other materials are available only to "friends" to whom you grant access. That doesn't guarantee security, but it's a start.

Don't click on links or attachments in e-mails unless you know what they are and who sent them. If you get unsolicited e-mail asking for personal data such as your Social Security number or financial account numbers--for any reason--report it to fraud.org. The Federal Trade Commission's identity theft Web site also has useful information.

You tell a friend on a MySpace blog that you're going on vacation for 10 days. Innocuous?

Use only trusted, secure Web sites when you enter sensitive personal information online. Rather than cut and paste links from e-mails, type the Web address in your browser directly. Once there, look for "https" in the URL and a locked-padlock icon in the frame of your browser window.

Use a spam filter, virus scanner, and firewall on your computer, and keep them updated. If you work from a wireless router, secure it with a password.

Know what your children are doing online. If they are active on social networking sites, visit their sites regularly to see what's going on, and insist that they guard their identities and restrict access to anything that contains personal information.

Published May 28, 2007