Phishing attacks | Internet safety | Khan Academy

Let's say you get an email like this where it looks like it is from PayPal. It says "response required" really big, so this is a little bit scary. It says, "Dear you, we emailed you a little while ago to ask you for your help resolving an issue with your PayPal account. This seems really serious—your account is still temporarily limited because we haven't heard from you. We notice some unusual login activity with your account. Please check that no one has logged into your account without your permission."

This is scary! To help us with this and to see what you can and can't do with your account until the issue is resolved, log in to your account or go to the resolution center. As always, if you need help or have any questions, feel free to contact us. We're always here to help. Thank you for being a PayPal customer. Sincerely, PayPal.

What would you do in this situation? Well, I think for a lot of us, our emotional response is, "Hey, PayPal, that's some of my money involved there! They're talking about other people maybe trying to log in. I definitely want to resolve this."

Just in the heat of the moment, you might click on this login, or you might go to the resolution center, and that might start you down a little bit of a scary path. Because even though this looks like PayPal, you really need to verify that it really is PayPal. There are some clues here that make it clear that it is not PayPal. See if you can find those.

Well, the biggest clue is up here on the email address. So it says "service at intl.paypal.com" as its name, but when you look at the actual email address right over here, notice it actually isn't a PayPal email address. It says "@outlook.com." So this is a pretty good clue that this is not from PayPal.

So what is this? Well, this is known as a phishing attack. Why is it called a phishing attack? Well, I think it's probably based on the idea that when you're trying to cast catch fish, you dangle some bait for the fish and you see which fish are going to bite.

And so, this isn't exactly fishing; they spelled the sound "ph" because what they're really doing is they're dangling some bait in front of you and seeing if you're going to metaphorically get your cheek cut by the fish hook or whatever happens to fish before they get pulled out.

And how would that happen metaphorically? Well, when you click on this, it probably goes to this fishy company or person's website, and that website might look like PayPal, but it's not going to be PayPal.com. It's going to be some other web address.

One way to avoid doing that, beyond looking at that this is a fishy email address, is that in some browsers or in some email readers, you can scroll over this, and you'll see what the website would be. Or you can right-click on that, you could say "copy the URL," and you could put that in a text document to see what the actual URL is. And it's very likely that that is not going to be a PayPal URL. In fact, I would guarantee you in this case, it would not be.

It would look like PayPal when you get there, and what they'll probably try to get you to do is type in your username and password for your PayPal account. Why is that valuable for them? Well, you just would have then given them your username and password for your PayPal account, which then they could use to steal money from you or to do something else to you.

So be very careful where you get these urgent emails or texts. I got a text recently saying that your Amazon account has been compromised. Click here fast in order to make sure that no more fraud happens on your account. Well, it turns out that the URL—the web address there—was not amazon.com. It was going to take me to a shady website, and that shady website looked a lot like Amazon.

So if I acted really quickly, I would have given them my Amazon username and password. So be on the lookout for these phishing attacks, and the main way to catch them is to be skeptical of anything that's talking about fraud, about something that would scare you.

And say, "Hey, do I really think this is happening?" Then, if you really think it might be happening, verify the email addresses, verify the web addresses—that they're really coming from who they say they're from. And it doesn't matter if the name is at somethingpaypal.com; you have to look at the actual email address. It doesn't matter what it says here; it matters what the actual URL is that it clicks to, to make sure that it isn't fishy, no pun intended. Or actually, that pun was intended.