"Recently our customers have reported receiving fraudulent e-mails that appear to be from Bank One," begins one e-mail that sure looks like it\u2019s from Bank One. "Please log in and learn more about what\u2019s happening and how to protect yourself."It sounds convincing enough. But recipients who follow the link will be taken not to Bank One\u2019s website but to a look-alike set up to gather user names and passwords. It\u2019s the latest kind of Internet scam, one that\u2019s known as "phishing.""They\u2019re fishing for passwords," explains Dave Jevans, chairman of the newly formed Anti-Phishing Working Group. Jevans, a senior marketing vice president at e-mail security vendor Tumbleweed Communications, notes that hackers have been using "ph" instead of "f" since the days of "phone phreaking" in the 1970s. "They\u2019re out there casting a wide net and pulling in a smaller number of fish."Some of the scams, which are documented at www.antiphishing.org, can be easily identified by their misspelled words or bizarre claims. Others are more sophisticated. Graphics and wording are copied straight from official company correspondence and websites. And not only do Internet users have to be leery of where an e-mail appears to come from, but it\u2019s also getting harder to identify bogus URLs. A recently discovered bug in Microsoft Internet Explorer allows fraudsters to blank out portions of Web addresses, making phony URLs appear legitimate, Jevans says. What\u2019s more, his group estimates that it takes law enforcement an average of 160 hours to shut down a fraudulent website when it\u2019s hosted outside the United States (of which 40 percent are). By that time, about 5 percent of a company\u2019s customers who have received the e-mail may have fallen for the scam. The result? A nightmare of password changes or fraudulent transactions.Although the scams are impossible to prevent, CIOs can take steps to mitigate the damage, says Howard Schmidt, former vice chairman of President Bush\u2019s Critical Infrastructure Protection Board, who is now CISO of eBay. "Those [e-mails] are most easily defeated by two things: making sure that online users of your product are educated that these things are oftentimes fraudulent, and encouraging them not to click on the link in the e-mail but to actually go to the [company\u2019s authentic] site," Schmidt says.Companies also need to remind customers that they will never ask via e-mail for personal information?and make sure employees who correspond with customers keep that promise. Finally, CIOs should have processes in place to collect customer complaints about spoofing and pass them on to law enforcement. In other words, you\u2019ve gotta try to keep the phisher from recasting his net.