and The text that appears between them will be in bold type. See line 4.

"href =" term is where you will be taken if you click this link. After target web address, tag must be "closed" with a right-angle bracket >. This tag must also be terminated with a tag. See lines 16-18. Anything that appears between and is simply a comment, regardless of fact that it may look like a web address. This information is critical to following analysis.

Here's actual HTML code that makes up eMail message. I have added line numbers for ease of reference – they are not part of HTML.

1. 2. "http://www.suntrust.com/images/Common/release3/logo_home.gif">

3. <.BR><.BR>

4. Dear SunTrust Client,<.BR><.BR>

5.

6. We recently reviewed your account, and suspect that your

7. Suntrust account may have been accessed by an unauthorized

8. third party.Protecting security of your account and of the

9. SunTrust network is our primary concern.<.BR>

10.

11. Therefore, as a preventative measure, we have temporarily

12. limited access to sensitive Suntrust account features.<.BR>

13.

14. Click link below in order to regain access to your account:<.BR><.BR>

15.

16.

17. https://internetbanking.suntrust.com

18.

19. <.BR><.BR>

20. We received a massive identity thefts targeting SunTrust so

21. we suggest you to Confirm Your Banking Account within 24

22. hours.<.BR>

23.

24. DO NOT FORGET TO COMPLETE BOTH FORMS, to

25. avoid Credit Card Fraud.<.BR>

26.

27. We apologize for any inconvenience this may cause, and

28. apriciate your assistance in helping us maintain integrity of

29. entire SunTrust system.<.BR><.BR>

30. Sincerely,<.BR><.BR>

31. The SunTrust Security Department Team.<.BR>

Incidentally, note misspelling of "appreciate" on line 28. There are other errors also, such as a missing space in "party.Protecting" on line 8, and lines 20-21 are poor English. Real financial institutions rarely make such obvious errors.

Now, it is lines 16 to 18 that are critical to our investigation of this scam. Line 17 is apparently a link that suggests we will be taken to "internetbanking.suntrust.com". There is no reason to be suspicious of address itself because it is after all on SunTrust website. But…

Line 17 is not inside a tag, as denoted by an opening < and a closing >. The tag that indicates real target of link is on previous line, line 16. The text "https://internetbanking.suntrust.com" on line 17 is just that – nothing but text. It could just as easily read "Find Nemo here" and it would have same effect. The real target of link is, as line 16 indicates, "http://www.toyworld.org/SunTrust" because it is in "The moral of this story: Do not trust APPARENT links in HTML email. Either check underlying code as described above, or cut and paste apparent link directly into your browsers address line. If you click on it, you could end up at a scammers webpage that looks legitimate, but will be anything but.

In short "Click here" could take you to anywhere – you probably appreciate that. But "www.CitiBank.com" could also take you to anywhere. Like "Click here", it is just text, despite fact it looks like a web address.

If this newsletter has been passed on to you by a friend, please subscribe yourself so you can be sure of receiving next part in this series, when we'll take a look at disaster recovery – specifically, recovering data that has been lost from your hard drive.

Your main concerns should be: • Have you got a copy of all files you should have? • Have you really got very latest version of each of those files? • Was data transferred from hard disk to storage media without error? • Is integrity of storage media 100%? It only takes a scratch on a CD or a kink in a tape to render a lot of data unreadable and thus unrecoverable.

Finally, catch that few people ever think about until too late. Let's say you have an important file that gets updated periodically, a spreadsheet for example. Let's also assume that today someone accidentally deleted some cells or made a significant error in that file that was not caught at time. The file is saved and you take a backup. This goes on for a few days — edit, save, backup — before problem is noticed. What now? Of how much use will your backup be? Even if you are making redundant copies, how far back can you go to recover a pre-error copy of file? For most small businesses answer will be from zero to a couple of days at most.

OK, I could go on and on with examples of problems you can face even if you are making backups, but it's time for some answers.

Look, this is Internet age, right? If it wasn't for Internet you wouldn't be reading this, so I know you are connected. Further, if you are in business you probably have a broadband connection. The Internet connects you to "the world". Look at it another way: In backup terms, Internet connects you to off-site servers. With right accounts and services it connects you to off-site storage. And it's those special services that are available to you that will make all difference.

In my small office I have two tape backup drives, a couple of USB drives, several CD burners, floppy and LS-120 drives, external hard drives and networked computers. That's a lot more storage options than most small businesses would have. For long-term storage of files that I may never need again, but which I have to keep anyway (e.g. accounting records), I burn to CD. For everything else I backup to "the Internet".

That's right. I've got tape drives and tape backup programs and I never use them.

My backup is scheduled to take place in evening after I have finished for day. It is 100% automatic and requires no initiation from me. None at all — no swapping tapes, no inserting CDs, no anything else. It backs up any file that has changed since last backup. Plus, backup system keeps ten most recent versions of every file backed up during last 90 days.

No capital outlay. No extra hardware. No media to deteriorate and need replacing. No need to "remember" to take some action.

Online backup services are not all that new, but finding one that is extremely reliable, very easy to use, very affordable (even for an individual home user), and requires no term contracts is not at all easy. Here's service I have been using for over a year now: http://www.DataSafetyCenter.com

You really have to try this. There's a 15-day Free Trial, after which you are invoiced each month in advance for coming month, and you can quit at any time. This is ONLY way for individuals and small businesses to ensure reliable recovery of data with minimum cost, minimum risk and minimum effort.

Oh, and in case you're wondering what happens if data center itself suffers a catastrophe … each day data you have stored at center replicates itself to another data center in a different geographical location.

In under half-an-hour you can put backup problems behind you forever. Or … you can wait for Mr. Murphy to come calling. You already know he only visits at worst possible time.

If this newsletter has been passed on to you by a friend, please subscribe yourself so you can be sure of receiving next part in this series, when we will discuss a most important but little understood protective mechanism — Firewall.

-------------------------