One of the earliest phenomena of widespread e-mail access was the mass e-mailing of stories warning the reader about some great injustice, funny story, or a once-in-a-lifetime opportunity. The e-mails would get forwarded to hundreds of people who would also forward them, and within a day or two the story would race across the world.

Urban legends have always existed, even before e-mail. But, with the ease of communicating to tens or even hundreds of people with the push of a button, these stories really came into their own during the Internet age.

So, what does this have to do with security? Well, it is our contention that peoples’ tendency to forward these stories on to everyone in their address book was an early indication that people were more gullible in cyberspace than in the real world. It was the “crack in the door,” so to speak, that many of the scammers walked in through.

In addition to that, people who forward these e-mails look a bit foolish, so it is always a good idea to spend at least a little time fact checking before you click the Send button.

One of the best places to verify whether that e-mail you just received is true is http://www.snopes.com. This site has an encyclopedic listing of urban legends with descriptions of the stories and verification of whether the story is true (or whether the story is unverified). One of the best things they do at this site is debunk fake news stories that have a real but unrelated photo associated with them (typically someone makes up a story around a photo and it gets forwarded as news). The folks who contribute to the Snopes site are also good at identifying photos that have been altered with a photo editor.

One of the major changes made possible by the Internet is the number of people who invest in and trade stocks. It seems that just about everybody we know has some investments in stocks, whereas 20 years ago it was something that only wealthy people did. The reason for the boom in investing is twofold. First, the Internet made it easy for people to invest. No calls or visits to a brokerage, just point and click. Second, at the same time that most people received such online access to investing, the stock market hit an unprecedented period of growth (the so-called “bubble” in the late 1990s).

So far, this is all good. The problem with the situation though is that a lot of people out there have no idea what they are doing when it comes to investing. This creates a great opportunity for scammers to take advantage of people who invest without researching the stocks they are purchasing.

The scam involves what is known as a “pump and dump.” The bad guys start by throwing a little money into a stock. Then they “pump up” a relatively worthless stock by hyping it up on chat boards or in this case by sending out millions of e-mails. This creates a buzz about the stock, and more folks who do not want to miss out on such an “opportunity” start buying. It looks like the stock is getting hot, which drives the price up. This attracts new investors whose investments also temporarily drive the stock price up again, and so on. At this point, the scammers sell all their shares for a nice profit. Usually within days, the price comes crashing down because there was little or no value in the company’s stock to begin with.

This scam is surprisingly effective using e-mail. One of the tactics used quite a bit is the “accidental” e-mail, where it is made to seem like a hot stock tip was meant for someone else. Usually there is a hint of insider information that the stock is about to take off.

Please heed this advice: If you invest in stocks based solely on an anonymous tip, whether it comes via e-mail or is overheard in a bathroom stall or on a train, you are not an investor, you are a gambler. And not a very good one either.

If you do want to invest and are looking for information on a prospective stock, either consult reputable professionals at the brokerage of your choice or go to a site such as the following:

And, get good, solid information. If you want to gamble, go to Vegas.

Job boards and e-mail solicitations are full of offers to work from home and make thousands per week. These used to come in the mail and in the back of every supermarket gossip rag. With e-mail and the Internet, the cost of running such schemes came down to fractions of pennies.

These “opportunities” are usually pyramid schemes in which people who have previously been duped get paid to dupe other people. After the first few rounds, the whole thing collapses. Sometimes, the initiators of the scams get busted for fraud; with the Internet, however, it is much easier to start a sham business in countries with weak extradition laws.

Our advice: If you want to work at home, fantastic. But, consult a legitimate job site such as the following:

A money-exchange scheme is a scam in which the victim is notified that a large amount of cash is being held for them, usually in a foreign bank. Victims are told that to get the cash out, a retainer must be set up, which when paid will free up the cash for them. By putting up the cash upfront, victims are told they will receive a cut of the cash being transferred. In some cases, the perpetrators ask for the victim’s bank account and routing number so that they can “easily deposit the money.”

There are variations on this theme with regard to the story wrapped around the scam. Sometimes, a rich relative has died, and you have been identified as the sole heir. Sometimes, a small organization is notified, perhaps a church, that some rich foreigner wanted to leave the cash to it. No matter the story, it is all a scam. These people will take the upfront retainer money the victim gives them and disappear.

For some reason, Nigeria is often the country used in the scam, so much so that the scam is also called a Nigerian bank scam. It can and does originate in a lot of places, however, so do not fall for it. If you are approached via e-mail or by phone about one of these “opportunities,” contact the authorities. The SEC and the FBI are good places to start.

Another scam making its way around is the “hot” merchandise scam. In this one, victims are asked to agree to have some merchandise sent to their residence. The reason given is usually that the person ordering the stuff is in transit or because he is ordering a gift for someone who lives with him and he wants to keep it a secret. The victim is usually offered some money in exchange for the service.

The scam is that the merchandise is often purchased with bad checks or stolen credit cards. The thieves will come to your house, collect their stuff from you, and then disappear.

Although you may in fact get paid for your service, the paper trail of the ill-gotten gains leads the authorities to your door, leaving you to explain what happened. Oh, and by the way, if you notify the authorities after you have been hit, these people now know where you live. Also, good luck cashing that check they gave you. It is probably about as good as the credit cards they used.

The most important thing you can do to protect yourself online is to use common sense and have a good amount of healthy skepticism. Keep in mind that although you might not ever fall for one of these scams, members for your family or friends might, so it is worth talking about. Here are some guidelines to follow:

Unlike the other chapters in this book, there is nothing to hook up or enable on your computer or home network when it comes to common sense (although we wish we could bottle some and sell it).

A lot of people, even smart people, get burned by online scams every year. Both of us have received plenty of e-mails from college graduates with warnings to be careful on business trips lest we wake up missing a kidney and in a bathtub, information about a secret Neiman Marcus cookie recipe, notification that Bill Gates is giving away money, and, oh my, an avalanche of stock tips.

Just remember that it takes a willing victim for a scam to work. A little time, effort, and a healthy dose of common sense can keep you out of trouble.

The Securities and Exchange Commission (SEC) offers some good information about online scams and Internet fraud:

The U.S. Department of Justice also provides some good information on their site:

For a nongovernment perspective, you can visit Scam Busters, which also provides some excellent information: