Internet Explorer 7 Helps Users Fight against Phishing

  • Article

By Tariq Sharif
Program Manager, Internet Explorer, Microsoft Corporation

See other Security Tip of the Month columns

Phishing is a way to trick computer users into revealing personal or financial information through a website. A common online phishing scam starts with an e-mail message that looks like an official notice from a trusted source such as a bank, credit card company, or reputable online merchant. Recipients of the message are directed to a fraudulent website where they are asked to provide personal information, such as an account number or password. This information is then usually used to commit identity theft.

Microsoft Internet Explorer 7 has many new features that will help protect users against such attacks. One such feature is Phishing Filter. Phishing Filter uses three methods to help protect you from phishing scams. First, it compares the addresses of websites you visit against a list of sites reported to Microsoft as legitimate. This list is stored on your computer. Second, it helps analyze the sites you visit to see if they have the characteristics common to a phishing site. Third, with your consent, Phishing Filter sends some website addresses to Microsoft to be further checked against a frequently updated list of reported phishing sites.

If the site you are visiting is on the list of reported phishing websites, Internet Explorer will display a warning webpage and a notification on the Address bar.

You might visit a phishing website that hasn’t been reported yet. You might even be the first person to find the phishing site. When you visit a site that uses common phishing tactics but isn’t listed on the server as a known phishing site, Phishing Filter will display a strong yellow alert in the Security Status Bar, a new feature area located to the right of the Address bar as shown here.

Internet Explorer 7 has a menu option for you to report any phishing website that you find. Clicking on the warning message will open a menu where you can select a link to begin the process of reporting a phishing site. You can also find this option on the Tools menu at any time. Reported phishing sites will be evaluated and added to the list of reported sites on the server.

Another change that has been instituted in Internet Explorer 7 is that every IE window that opens from the Web will have a mini Address bar on it. These Address bars will help users verify the origin of such pop-up windows and help them make a trust decision to avoid phishing.

To help users make a better trust decision, Internet Explorer 7 has moved the Lock icon from the status bar to an area next to the Address bar. Additionally, if the website you’re visiting does not have a valid certificate or its certificate has been revoked, Internet Explorer 7 will block the navigation. With IE7, we will support a new High Assurance SSL standard that certificate authorities can grant to sites they believe are real businesses. With these certificates, a user will get much richer SSL experience. For example, if a website has a High Assurance certificate, the Address bar color will change to green and toggle between the identity of the site and the name of the certificate authority. We are currently working with various certificate authorities to set standards for the High Assurance certificates.

To help protect yourself from phishing attacks, be sure to do the following:

  • Turn on Phishing Filter in Internet Explorer 7.

  • Always look for a Lock icon when doing a financial transaction or giving personal information.

  • Pay close attention to the Address bar and make sure you are at the right site.

  • If you get an e-mail and you're not sure it came from your financial institution, call them to verify before following the instructions in the mail.