I got my first phish in my Gmail account today. It was the eBay - we need your credit card number updated one. I do not understand how somone unfamiliar with URL formation can know this is a hoax. My only clues were that I've never told eBay about my Gmail account and the URL the link led to was on the a .info domain. Now, really, how many people would - 1. catch the .info info and 2. know it's significance?
I think about my Mom. On the up side, I know she will never give out any passwords. She doesn't know them. She can't ever remember the difference between userid and password and she doesn't know which goes with which. Her system is set up so that she doesn't need to know. Yes there is a danger. Should some tech burglar come upon Charleston, SC, zone in on the retirement community, figure out which building is apartments, get in without keys and find his way up to Mom's 3rd floor unit - he can steal her blind electronically. It's a risk.
And the good news is that if she catches him, he won't get a time out. She raised her children before those came into vogue. He will, however, get grounded and likely have his allowance slashed.
