CIO — "Recently our customers have reported receiving fraudulent e-mails that appear to be from Bank One," begins one e-mail that sure looks like it’s from Bank One. "Please log in and learn more about what’s happening and how to protect yourself."

It sounds convincing enough. But recipients who follow the link will be taken not to Bank One’s website but to a look-alike set up to gather user names and passwords. It’s the latest kind of Internet scam, one that’s known as "phishing."

"They’re fishing for passwords," explains Dave Jevans, chairman of the newly formed Anti-Phishing Working Group. Jevans, a senior marketing vice president at e-mail security vendor Tumbleweed Communications, notes that hackers have been using "ph" instead of "f" since the days of "phone phreaking" in the 1970s. "They’re out there casting a wide net and pulling in a smaller number of fish."

Some of the scams, which are documented at www.antiphishing.org, can be easily identified by their misspelled words or bizarre claims. Others are more sophisticated. Graphics and wording are copied straight from official company correspondence and websites. And not only do Internet users have to be leery of where an e-mail appears to come from, but it’s also getting harder to identify bogus URLs. A recently discovered bug in Microsoft Internet Explorer allows fraudsters to blank out portions of Web addresses, making phony URLs appear legitimate, Jevans says. What’s more, his group estimates that it takes law enforcement an average of 160 hours to shut down a fraudulent website when it’s hosted outside the United States (of which 40 percent are). By that time, about 5 percent of a company’s customers who have received the e-mail may have fallen for the scam. The result? A nightmare of password changes or fraudulent transactions.

Although the scams are impossible to prevent, CIOs can take steps to mitigate the damage, says Howard Schmidt, former vice chairman of President Bush’s Critical Infrastructure Protection Board, who is now CISO of eBay. "Those [e-mails] are most easily defeated by two things: making sure that online users of your product are educated that these things are oftentimes fraudulent, and encouraging them not to click on the link in the e-mail but to actually go to the [company’s authentic] site," Schmidt says.

Companies also need to remind customers that they will never ask via e-mail for personal information?and make sure employees who correspond with customers keep that promise. Finally, CIOs should have processes in place to collect customer complaints about spoofing and pass them on to law enforcement. In other words, you’ve gotta try to keep the phisher from recasting his net.