Oh, a new one! Thanks for letting everyone know!

I'm confused. What would pressing no have done?

Pressing anything at all is like a hook. Once you establish the connection, your data is exposed. It’s not the Yes or the No, it’s pressing anything at all. Clever, I tell you.

Credit card security departments don't send emails. The IRS and Microsoft don't make phone calls. The return address of unexpected emails should always be looked at (sometimes the address is phonied-up but usually not). Links in any email from an unfamiliar source (unfamiliar meaning, not someone you've received an email from before) should never be clicked.

Links in such emails (as everyone gets to some extent) may lead to a malware download or just be an effort to take visitors to a website. Consider changing your email provider and using a different user name if you receive too many.

These are the modern versions of common knowledge and good advice - as in the past one would tell children not to accept candy or rides from strangers, know to not open your front door to someone you don't know and don't stand in water when using ungrounded electrical devices.

Sleeperblues wrote:

I'm confused. What would pressing no have done?

Never ever press a link in an email. Period. You will download viruses, open the door to exposing all your data, and who knows what other mischief.

Elmer,

CapitalOne (our daily-use travel points card) actually DOES email us, in addition to texting us, when suspicious activity shows up. It's immediate, but we did sign up for those alerts years ago after our burglary.

Funny, though - they've finally figured out that purchases of airline/train tickets for departures in Europe are generally legit, after several "holds" on charges when their software was learning our purchasing patterns.

When my debit card and others in this area last fall I received a phone message that there was suspicious activity and account was frozen. I used my laptop to check the bank account website before doing anything. I confirmed on the website. Being suspicious I did not want to use my cell phone in case it would link a spammer to my accounts. I would suggest checking on an alternate source just in case.

I'm glad you posted this, bossyvossy. I've received phonecalls and texts from my credit card company, so I would not have ruled out getting an email from them. Now I'll know better.

Elmer (or anyone more computer literate than me), is there a good way to spot if the sender's address has been spoofed into appearing legitimate?

I use windows live mail, and it shows up as something like (made-up example) amazonrewards@sueshairsalon.net or some such. The "sender" and the address won't match.

Mine does send messages, but refers to an exact purchase place and amount almost immediately made.

Never, ever click on any links you are not 100 percent certain are legit.

The msg I received referenced a specific purchase. It was gardening related and I purchase a good amount online. Very possible. I also get emails on specific transactions over a certain $.

The danger here was how close I came to pressing the button or link. Almost like a kid walking to the seedy van to look ar the pretty puppy.

I an not kidding when I say I pray that these genial hoods get inspired to direct their intellect towards noble endeavors.

I follow this practice as a matter of course:

1. Never, ever click on any links you are not 100 percent certain are legit.

I even take it further and often delete suspicious emails I receive without reading them. Furthermore I use a third party email client, and have remote content in email disabled, and have javascript disabled by default everywhere and have other high-security/high-privacy settings in the browser I use.

But I've never really understood the dangers of clicking on a link in email, or more specifically how clicking on a link in an email would be any different from clicking any link anywhere.

Elmer wrote:

1. Links in such emails may lead to a malware download or just be an effort to take visitors to a website

Maybe it is merely that the measures I have already taken somewhat de-fang the possibility of malware download, and phishing attempts seem that they would require you to enter information into the website that was linked to, (which I'm not likely to do).

Thinking about it, one possibility that would still be a valid danger is that if the link contained some indication of the email address to which the message was sent, then clicking it would inform them that it is an actively used email account, and make you the target for even more spam and phishing. <-- yeah, don't want that.

chloecat, my main credit card issuer (Chase) doesn't send security emails, they text or call. And the message is, "Please call us using this phone number: XXX". Never a link.

nickel - I don't know if anything can be done to be certain if the return address is spoofed. Revert to suggestion #1, it's best to never click on a link in an email you aren't certain of. My main email receives no spamming messages but the one I use for miscellaneous things, like this website, does have some get through and the strangeness/obvious non-normal words of return addresses of garbage messages are usually pretty obvious.

bob - I think you've said you work in some kind of an IT role. The settings you've made are well informed but beyond what most users would do. As far as confirming the active nature of an address, I think the large scale spammers assume that's the case except for messages bounced by the provider as being no longer in service. Think about it, the additional cost of sending an extra 100 million messages to perhaps dead accounts is zero. Maybe they covet the ones that are confirmed but again, users following best practices would never do that.

One just must be careful and suspicious. I have even gotten emails pretending to be from Apple telling me my account is locked and I must select a new password. Really? Hmmm... I do forward these to Apple as they want them to help them track down these frauds.

Sorry, I read the OP too fast. I thought it was a phone call, with a press 1 for yes or 2 for no kind of thing. Did not realize it was an email. Good pick-up and thanks for the heads up.

Virtually every credit card I have has an option to set alerts via email or mobile. I manage all my accounts online. I don't do mobile banking. Common sense, strong security settings = no problems. Sure I get phishing emails. Everyone does, but with all the info on avoiding scams out there today there is no excuse for not staying aware. Most of the crap goes into my junk folder. Any other is easily dealt with by using the delete feature.

My credit card company communicates by phone. NO text messages - I actively loathe those.

If paypal, my bank or my credit card ever send me an email, I always always double check on their actual website for the same message. No message there, I delete the email.

I get e-mails from my Capital One VISA questioning charges that don't fit my profile: They read, in part:

"Our fraud defenses flagged the purchase below as unusual for your VISA SIGNATURE card ending in XXXX. Do you or an authorized user recognize this purchase?"

I also get texts.