Be on the lookout for "phishing" scams

Does this look familiar?

"Our security department has detected unauthorized activity on your account. For your protection, your account will be suspended until you confirm your identity. Click here to confirm your identity.”

"In accordance with our site policy, we need you to verify your password, credit card and social security numbers using the following link..."

You may have received email messages that claim to come from Expedia (or other reputable businesses) which ask you to reveal sensitive personal or financial information. These messages are actually examples of an increasingly common form of online scam known as "phishing." The people who send these fraudulent emails hope to trick you into revealing information which they can then use for any number of purposes, including use of your credit cards and identify theft.

What to look for

The emails can be quite convincing, since they appear to come from established businesses or organizations, and they usually contain links to equally legitimate-seeming Web sites. However, there are a number of ways to tell that these emails and their accompanying sites are bogus:

• Requesting sensitive personal or financial information. Expedia will never send an email (or call) asking you to verify passwords or other personal or financial information. For details about our privacy and security policies, visit our Privacy Pledge page.
• Alarmist language. The threat of account suspension is just one of many scare tactics that email fraudsters use to try to get you to act in haste. Don’t take the bait.
• Poor grammar and spelling errors. While some messages are very well written, a large number contain poor grammar or spelling mistakes. Such mistakes are a warning sign, as reputable organizations take time to avoid this.
• Fake links. These come in two main varieties:
  • Links that appear to be related to the site being impersonated, or “spoofed” (e.g., http://expedia-security.com, which is not an Expedia site)
  • Links that match the URL of the site in question but have different URLs embedded within them (e.g., click on http://www.expedia.com and you’ll see that it takes you somewhere else entirely)

When viewing links on a Web page, you can often see what a link’s actual URL is by hovering your cursor over the link (don’t click it!) and looking at the destination address that appears in the status bar, in the lower left hand corner of the browser window. If they don’t match, then you’ve got a spoof.

For more information on avoiding phishing scams, see APWG Consumer Advice.

Legitimate Expedia emails

You may receive messages from Expedia from time to time. Expediamail.com is a valid domain used by Expedia to communicate with customers. As such, it may appear as part of the sender’s address in email messages or as part of a link in an email.

You may also receive email messages about Expedia® Elite Plus™, a new, invitation-only travel rewards program that provides special offers and benefits to our top customers. These offers are available only through the authorized Elite Plus Web site.

What to do if you receive a message from “Expedia” that you believe is fraudulent

Do not reply to the message, or click on any of the links. If you think you have received a fraudulent message, forward the entire message to spoof@expedia.com, then delete the original from your inbox. You may receive an automated reply to let you know that we have received your message, but we will not contact you again unless we need further information. Most of the time, all the information we need is contained in the spoofed email itself.

The Federal Trade Commission's phishing scam page has the most up-to-date information how to detect phishing scams and protect yourself against identity theft.

If you have other questions, you can contact us by email with our support and feedback form. Expedia Customer Support is also available 24 hours a day, 7 days a week at 1-877-787-7199 or 1-404-728-8787.

Print