Don't trust that link sent to you in email...

This article will result in a lot of experts proclaiming, "duh" - but I think this information is pretty non-intuitive even for relatively savvy daily users.

Many email messages are composed in HTML, the same "language" used to create web pages. This allows the message creator to include special text formatting, tables and images. Spam is often composed in HTML as it lets the advertiser create a mini-brochure pitching their product. HTML can also be used to hide content, making it tricky for spam catcher programs to determine the real message content.

It also makes it easy to disguise where any links in the email really point to. This is often used in "phishing" type spam to fool users into clicking on links that appear to point to their bank or other site which they might provide confidential data to. The links really point to phony sites which record any data entered into a database run by the scammer.

http://en.wikipedia.org/wiki/E-mail_spam provides a nice summary on the problem of spam email.

http://en.wikipedia.org/wiki/E-mail_spam provides a nice summary on the problem of spam email.

Try clicking on the two links above. Did I just blow your mind?

The code behind the second example looks like the following:

<a href="http://www.spam.com/">http://en.wikipedia.org/wiki/E-mail_spam</a><p>

So, as you can see - creating links in email messages that point someplace other than where they appear doesn't exactly require a genius. The good news is that this kind of tactic should be detectable by spam blockers. SpamButcher doesn't do this yet, but it may in an upcoming version.

Some email programs will show the real link destination if you mouse-over it. However, it's easy to forget to do this.

If you get an email claiming you need to log on to your bank account or similar website, the best approach may be to manually enter the URL you know to be correct into your browser. Also, if there's really a problem, it's likely your bank won't rely upon email as the only way to contact you. Just deleting the message is probably fairly safe.

Back