Don't get hooked by an Internet crook

Becoming the victim of online identity theft is like playing the lottery. The odds are long, but if your number's up, there's a lot of money involved.

A recent study by Javelin Strategy & Research says that although there were as many as 9.3 million identity fraud victims in the United States in 2004, fewer than 2 percent of them were victimized by phishing. Javelin estimates losses to phishing last year totaled $367 million.

Phishers are pirates who try to steal your personal information by casting millions of phony e-mails out on the Web that purport to be from well-known institutions. Embedded in the message is a link to a fake Web site that looks like that of the real company. At the fake site, you're instructed to enter your user name, password, identification number and other personal data. Phishers can then drain your accounts or make unauthorized purchases.

To beat fraud, take these steps:

• Don't click the link. Even if an e-mail looks official, don't respond. Close the e-mail and log on to the merchant's or bank's site to contact customer support. Or phone the institution and ask about the e-mail query.

• Load anti-virus, anti-spyware and firewall software on your PC. This simple step will help prevent criminals from installing keystroke loggers and other harmful programs on your computer (see kiplinger.com/magazine/links for the latest in protection software).

• Vary your passwords. Many of us use the same password for multiple sites, including those with poor security. If a less-secure site, such as a local mom-and-pop retailer, is hacked, the crooks can gain access to your other accounts.

To avoid the hassle of remembering a host of different passwords, consider Pass2Go ($40; www.roboform.com), a product that will remember them for you and input them with the click of a button on your browser. Pass2Go saves your passwords to a USB flash drive (for an extra $10, the company will sell you the drive). It's simple to unplug the gum pack-size drive and drop it in your pocket, keeping the passwords stored on it out of hackers' reach.

• Protect your Social Security number. Never use your SSN as your login ID. Phishers can cause all kinds of mayhem if they get your number.

• Wipe the disk. Before tossing an old computer, overwrite all the files on the hard disk, which may contain plenty of personal information. Many software utilities overwrite disks, including Eraser, a free program available at www.heidi.ie.