What is phishing / spoofing?

The term 'Phishing' (also known as spoofing) comes from 'fishing' - basically because Internet scammers use email as bait to trick username / password or personal and financial information from unsuspecting users.

Typically they create emails that look like they have come from another company (usually a bank, ISP or other online service) - often saying that they need to update or verify the details on your account. They link to web sites that 'look' similar to the normal login screens of ISP's or banks - the unsuspecting user is thereby tricked into entering their details which the scammers can record and then exploit.

Where online banks are the target money is usually transferred out of the exploited bank account to a 'mule' - they they get the mule to withdraw the money and send it by wire transfer to the scammers (who are usually overseas). The reason they need to use a mule is that most normal bank accounts cannot directly transfer money overseas.

The 'ph' replaces the 'f' - this probably originated one of the original hacking exploits - 'phreaking' - a method that used a device (called a 'Blue Box') to imitate tones used by early telephone systems to get free telephone calls.

Also see: How to avoid phishing scams