• Why cell phone outage reports are secret

    Consumers have no idea how reliable their cell phone service will be when they buy a phone and sign a long-term contract. The Federal Communications Commission could offer some guidance, but it won't. The agency refuses to make public a detailed database of cell phone provider outages that it has maintained since 2004.

    A federal Freedom of Information Act request for the data, filed in August by MSNBC.com, has been rejected by the agency. The stated reasons: Release of the information could help terrorists plan attacks against the United States, and it would harm the companies involved.


    Complaints about cell phone service are near the top of every list of consumer gripes. The Illinois attorney general's office, for example, last year ranked cell phone complaints as the fourth-most-common complaint, trailing only gas prices, credit card firms and home improvement scams.

    To find out if a cell phone carrier service will be reliable, consumers are forced to buy a phone, then use it at home and on their normal commuting routes. Callers generally get 30 days at most to return a phone if the service doesn't work well enough.

    But that test won't reveal anything about carriers' periodic outages.

    The Federal Communications Commission does know something about outages, however. It has collected outage reports from telecommunications firms since the early 1990s. Any time a carrier has an outage that affects 900,000 caller minutes – say a 30-minute outage impacting 30,000 customers – it must report it to the Network Outage Reporting System.

    In the beginning, the reports all were from "wire line" telephone providers and were available to the public. But in 2004, the commission ordered wireless firms to supply outage reports as well. But at the same time, it removed all outage reports from public view and exempted them from the Freedom of Information Act.

    The FCC took the action at the urging of the Department of Homeland Security, which argued that publication of the reports would "jeopardize our security efforts."

    "The same outage data that can be so useful … to identify and remedy critical vulnerabilities and make the network infrastructure stronger can, in hostile hands, be used to exploit those vulnerabilities to undermine or attack networks," DHS said.

    'Corporate competition protection'

    What use would wireless outage reports have to would-be terrorists? Not much, said NBC terrorism analyst Roger Cressey, the former chief of staff of the President's Critical Infrastructure Protection Board.

    "There is nothing mysterious behind it, it is corporate competition protection," said Cressey, now a partner in Good Harbor Consulting. "The only reason for the government to not let these records get out is then one telco provider could run a full-page ad saying 'the government says we're more reliable.'"

    Cressey added that he couldn't imagine a scenario where the reports would be valuable to terrorists.

    In October, MSNBC.com filed an administrative appeal of the FCC's rejection of its FOIA request. The FCC has not yet responded to the appeal.

    In its initial answer to MSNBC.com's FOIA request, FCC officials cited only one reason for the denial: "competitive harm" to companies involved.

    "NORS records are not available to the public," the rejection letter said. "Given the competitive nature of many segments of the communications industry and the importance that outage information may have on the selection of a service provider or manufacturer, we conclude that there is a presumptive likelihood of substantial competitive harm from disclosure of information in outage reports."

    That's likely true. A report that revealed which mobile phone company suffered the most outages in a given area would likely impact consumers' choice of provider. Such information would be in the public interest, MSNBC.com believes.

    "We believe that this is basic consumer information and we will continue to fight for your right to know it," said MSNBC.com editor-in-chief Jennifer Sizemore.

    Explanation doesn't measure up, expert says

    The explanation also does not meet the bar set by the Freedom of Information Act for an agency to decline a request, according to an analysis by The Reporters Committee for Freedom of the Press.

    The competitive harm exemption "requires fairly detailed explanations by the company involved as to how the release of information will put it at a substantial competitive disadvantage," said analyst Nathan Winegar.

    In a subsequent response to a reporter's query, an FCC spokesman pointed toward the second reason for the public record request denial: The 2004 administrative order declaring the outage records off limits to the public. That order cited both competitive harm and national security.

    Al Tompkins, a Freedom of Information Act expert at the Poynter Institute, a journalism think-tank, said release of the cell phone outage reports would be "a tremendous consumer tool," and compared them to the Federal Aviation Administration's publication of airline on-time records.

    "It seems to me that while one could understand it might put one company at a competitive disadvantage, it would put another at a competitive advantage," he said. "The airwaves are owned by the public. … The public has a need to know what's reliable and what's not."

    Not every mobile phone firm thought the database needed to be hidden from public view when the FCC decided to make it secret in 2004. Sprint argued that the commission could "scrub" the reports of sensitive material before they were made public and thus serve the "seemingly divergent needs for public access and protection of confidential information."

    The FCC chose the blunt instrument.

    Another 'national security issue'

    Tompkins said the blanket removal of the entire outage report system from public view was symptomatic of a larger trend in the Bush administration.

    "Every time we turn around something else is a national security issue," he said.

    Furthermore, if some larger pattern of cell phone outages could be gleaned from the reports, he said, companies might "fix it, not bury it."

    "I can't think of one problem that has gone away because it's kept a secret," he said.

    The Freedom of Information Act, signed into law in 1966, provides specific procedures for U.S. citizens to gain access to government documents, through a procedure known as a FOIA request. The law was amended in the mid-1970s in reaction to the Watergate scandal, with time and fee limits imposed on government agencies to comply with requests. The law was amended again in 1986, but journalists continued to complain that federal agencies were still stonewalling. In response to those complaints, in October 1993 then-President Bill Clinton issued an administrative memo calling for federal agencies to "renew their commitment" to the spirit of the Freedom of information Act.

    The law was originally intended to make government paper records available to the public, but gradually has been extended to apply to electronic records as well.

    Anyone can file a FOIA request, but the procedure is most frequently used by journalists, lawyers and jail inmates seeking more information about their cases. Many agencies, including the FCC, now allow FOIA requests to be filed right from their Web sites.

  • Meatpacking raids: A victim's story

    Theresa Sanchez was expecting a $5,400 tax refund when she opened a letter from the IRS in January 2003. Instead, she got a bill demanding payment of taxes on $120,000 in undeclared wages. Someone using her name and Social Security number had earned the money through a series of jobs dating back to 1996 and had not paid any taxes on the income, the letter said.

    Sanchez complained to the agency and to the Federal Trade Commission that her identity had been stolen, and was being used by someone to gain employment. Nonetheless, more than two years later, in April 2005, a woman walked into the Swift & Co. meatpacking plant in Greeley, Colo., and used Theresa Sanchez's name and Social Security number to get a job.



    The woman's employment ruse became public knowledge Tuesday when authorities raided Swift & Co. plants in six states and arrested approximately 1,300 illegal immigrants suspected of buying or stealing other people's identities to secure U.S. jobs.

    The suspect accused of illegally using Sanchez's identity is identified only as Jane Doe in an affidavit filed by authorities Tuesday in Weld County, Colo., district court.

    Attempts to find the real Sanchez, who lives in Texas, were unsuccessful. Neither Immigrations and Customs Enforcement officials nor the Federal Trade Commission would provide additional details about her or her case.

    But MSNBC.com was able to piece together part of her decade-long identity theft ordeal from details provided in the affidavit.

    Sanchez told investigators that she suspects her ex-husband gave the information to an imposter about 10 years ago.

    It's not clear why that person – and apparently many others – was able to use Sanchez's personal information to obtain employment – and, in some cases, pay taxes -- even after she alerted federal agencies nearly four years ago that the data was being used for employment fraud.

    Government doesn't warn consumers

    And over the entire 10-year span, federal agencies like the IRS and the Social Security Administration could have detected suspicious use of her Social Security number, since they were collecting taxes from multiple jobs at multiple locations. But it is not the policy of either agency to warn consumers that their number might have been been stolen.

    It happens often. Each year, 8 million to 9 million people pay taxes using the wrong number – some are mere clerical errors, but many are undocumented workers skirting the system by supplying a fake number and another name. In the Swift case, the imposter took on Sanchez's identity, using her real name and Social Security number in a ruse designed to trick even the newest employment verification system, called Basic Pilot.

    "The government has known since at least August 2005 that the current Basic Pilot program cannot successfully detect identity theft and would likely permit an unauthorized worker to be improperly verified," U.S. District Judge Mary Lou Robinson wrote in her order denying an injunction filed by Swift to stop the raids.

    "Some Social Security numbers are widely used at multiple locations, over 200 workplaces for some numbers," she wrote.

    The size of the problem is obviously massive. ICE officials said about 30 percent of Swift's workforce had filed I-9 employment forms with questionable information. There's no reason to suspect the Swift is unique in its industry.

    Total number of victims unclear

    And Sanchez apparently was just one of hundreds of victims in the Swift case. It is not clear how many IDs were used to obtain employment at the plants, but a fascinating compilation of Colorado-based cases on the Greeley Tribune's Web site gives some indication of the scope.

    It's not clear what prompted ICE officials to put a sudden end to their ordeal with the largest work-site enforcement action ever taken.

    But there were some hints at Wednesday's press conference. Homeland Security Director Michael Chertoff complained that his agency is legally barred from communication with the Social Security Administration about Social Security numbers that are used twice.

    "The law does not allow Social Security to refer cases to us when the Social Security number is used at multiple locations," he said. "A better solution requires congressional Action. …We urge Congress to act."

    If it does, it won't be soon enough for Sanchez, who has no way of knowing whether her data was sold or shared with any other undocumented workers.

    Federal Trade Commission chairman Deborah Platt Majoras said Wednesday that her agency is reaching out to Swift-related imposter victims, but there is still no way for Sanchez and the other victims to know if anyone else is using their personal information.

    Chertoff said one Swift-related ID theft victims had been arrested in Texas because his imposter had committed crimes. Other had multiple loans and credit cards taken out in their names, and had their credit ruined.

    "There is a persistent hardship which follows this crime," he said.

    Very persistent, as Sanchez's decade-long ordeal demonstrates.

     

  • Jewelry at half-price? Well, kind of

    Truth in AdvertisingYou've probably noticed the ads, particularly if you are thinking about getting something sparkly for someone you love this Christmas. They promise that any jewelry you buy will appraise for twice as much as you pay for it. A Red Tape reader recently wrote to me and asked, "How can this be?"

    Well, there's good news and bad news. Internet-based jewelry stores have really changed the economics of the tight-lipped jewelry business, leading to more choice, and more price transparency, which is always a good thing for consumers. On the other hand, Web jewelry sales have also opened up a whole new language to consumers, which invites the opportunity for word-play and potential confusion. That's what we have here.


    Can you buy something from a jewelry store at half the price it's really worth? Of course not. Can you buy something and get it appraised at twice the price you paid or it? Yes, you can.

    That doesn't make sense -- until you understand that appraised and market value are two very different things. Before you buy jewelry this holiday season, it's important for you to know how appraisals work.

    Let's look at the promise made by JewelryExchange.com. The site's disclaimer page explains the firm's "Double Value Guarantee."

    "We guarantee the retail value of all finished jewelry manufactured by the Jewelry Exchange and not requiring center stones or customization, that is priced under $3,000, to appraise for double the purchase price." The store goes on to explain what it defines as a valid appraisal and what the reward is for beating their claim (either a refund or a store credit for the difference).

    How can Jewelry Exchange do this without going out of business? Before we explain what's going on, let's have jewelry analyst Ken Gassman demonstrate the best way for a consumer to assess such a guarantee.

    "Any store which makes this kind of promise, tell them, 'Show me the money,'" he said. Ask the store if they will give you $6,000 if you buy the ring for $3,000 and sell it back to them, he said. Their answer will reveal a lot about the guarantee.

    But notice, the guarantee says nothing about retail value. It applies only to an appraisal value, which is a different thing. And jewelers tell me the appraised value of an item often is twice the amount consumers pay in a discount retail shop.

    Multimedia special report: A diamond's journey

    Many appraisals are ordered to establish value for insurance purposes (some insurers require an appraisal), and they represent replacement value. Insurance companies are fond of planning for worst-case scenarios, so an insurance appraisal may take into account the actual cost of replacing an item at a full-price store five or 10 years in the future. The insurance firm likely won't have to pay that amount, but remember, a higher appraisal means a higher premium.

    Meanwhile, a love-struck man who bought his girl a diamond bracelet and gets a high-priced appraisal will feel like a million bucks if he thinks the gift is worth more than he paid for it. So what's the harm?

    Only worth what you pay for it
    The harm occurs if that love-struck man gets the notion that the bracelet he just bought really is worth twice what he's paying for it.

    Bill Doddridge, owner of Jewelry Exchange, said that never happens because his salespeople don't pitch the appraisal guarantee as if it's a retail price guarantee.

    "(Jewelry) is only worth what you pay for it," he said. "We are not saying it's worth double."

    Gassman said he was concerned that such a guarantee might confuse consumers, who rarely understand the nature of the jewelry business and the relationship of appraisals to retail price.

    But Doddridge said if there's any criticism to be levied, it should be aimed at the appraisal business.

    "I'll stop (using the slogan) the day appraisers stop appraising (our) things for double," he said. The store really does abide by its guarantee, he said. If consumers come in with a low appraisal -- and it happens a couple of times a year -- the store offers a refund or compensation.

    He also says Jewelry Exchange pieces are often half the price consumers would pay in a high-end store like Tiffany's, because the company manufactures its own pieces and uses other cost-cutting techniques.

    But is the use of the phrase double-value misleading? Elliot Goldman, the Jewelry Exchange's lawyer, says no.

    "We stand buy our guarantee. I don't think there's anything misleading about that," he said.

    Different kinds of appraisals
    Confused yet? The world of appraisals can get even more confusing, warns long-time appraiser Maury Woulf, an accredited member of the International Society of Appraisers and a jewelry store owner. Not only is there a big difference between the appraised value and the market value of an item – there can be big differences among various appraisals conducted for different reasons.

    The aforementioned insurance-related appraisal might produce one value. But an "income-value" appraisal, conducted for aging jewelry owner worried about the impact jewels might have on any estate tax an heir would have to pay, would likely produce a different value – probably much lower, for obvious reasons.

    Appraisals also are impacted by market conditions, Woulf said. A house in eastern Pennsylvania could be double or triple the price if it was located in Northern New Jersey – and the same ring sold online could be double the price if sold by Tiffany's. Such market considerations are a big factor in appraisals, Woulf said.

    "When your wife holds out her hand and tells her friends you bought it at Tiffany's, it is a different product at that point," he said.

    And of course, appraisers are human, and will often disagree over the value of an item.

    Some mixture of these factors explains how a store could issue a guarantee that items it sells will appraise for twice the value, he said.

    Blue Nile, one of the Web's largest retailers, makes no such double value claim, said spokesman John Baird. He did say consumers can often get very good jewelry prices online, but should tread carefully.

    "People should comparison shop," he said. Independent grading of diamonds by non-profit laboratories, in particular, make things much easier for consumers. "Diamonds in particular are a very objective product," he said. "... You can compare apples to apples. So do your research."

    That research should include understanding promises connected to the value of an appraisal.

     

  • Researchers: Software can nip eBay fraud in the bud

    EBay users worried about fraud, take heart: Researchers at Carnegie Mellon University say they've invented data mining techniques that can detect online auction fraud before it happens. By looking at trading patterns among thousands of eBay sellers, the researchers say they can identify likely con artists and warn off potential bidders.

    "We want to help people detect potential fraud before the fraud occurs," said research associate Duen Horng Chau, who developed NetProbe with professor Christos Faloutsos, undergraduate student Samuel Wang and graduate student Shashank Pandit.


    EBay sellers gain their credibility largely through the use of an extensive user-generated feedback system. Buyers give good marks to sellers who deliver goods as promised, and generally sellers with high feedback ratings are safer to purchase from. But con artists long ago found ways to "game" the feedback system, either by creating fake eBay buyers to artificially inflate their positive rating or by working with other criminal associates.

    Carnegie Mellon's system, called NetProbe, examines connections between buyers and sellers to look for patterns of artificial feedback. By drawing connections between groups of eBay users, the software can make associations between otherwise anonymous eBay sellers and known criminals, for example.

    "Essentially, we are trying to find fake users," Faloutsos said.

    These associations, which might not be apparent to the naked eye, can then be used to warn potential buyers, Faloutsos said.

    He said the system works because it is able to scan several layers deep into connections between eBay users. "For example, we are looking at the people who traded with the people who traded with me," Faloutsos said.

    In its most recent test, Carnegie Mellon researchers loaded the full transaction history of 70,000 eBay users -- 1 million trades in all -- into a database. Running the data through NetProbe, the researchers were able to correctly pick out 10 previously identified criminals. They also identified more than a dozen probable fraudsters and several dozen apparent accomplices, the university said.

    Larger tests are planned, and so is a commercial product, though school officials said they didn't know if NetProbe would be offered directly to consumers. Theoretically, though, potential bidders could run a one-click fraud test on a seller and get back a score indicating the likelihood that the seller was a criminal, Chau said.

    Scoring systems common online
    That would be a bit of Internet turnabout. Similar scoring systems are used to analyze risk levels in many Internet-based transactions, but they are generally used by sellers to analyze buyers. Most e-commerce sites use fraud scoring products to detect the likelihood that a buyer is using a stolen credit card to purchase merchandise, for example.

    The NetProbe software can actually be used to predict eBay crime because it takes some time for criminals to artificially inflate feedback scores, the researchers say. Even the shortest eBay auction takes one day.

    "Real fraudsters who want to make fake reputations, they still need some time to build those," Faloutsos said. By detecting the creation of fake reputations in real time, fraud can be stopped before it starts, he said.

    EBay had not been consulted in development of the software, Faloutsos said, and the company did not immediately return calls seeking comment.

    Fake feedback not the biggest problem
    EBay fraud expert Rosalinda Baldwin, who runs The Auction Guild Web site, welcomed the research project but said she was skeptical of its widespread usefulness.

    Manipulated feedback scores, while a problem for eBay, are not the site's chief source of fraud, she said. Most eBay criminals use hijacked account to commit fraud, allowing them to impersonate legitimate, well-respected eBay members. NetProbe's relationship testing would be powerless to find such fraud, she said.

    Consumers can also do their own relationship analysis using eBay's site, she said. In fact, no one should ever bid on an item and not click through a seller's feedback contributors to see if anything looks suspicious, she said.

    She said NetProbe would be useful at stopping another common eBay problem – shill bidding, in which sellers artificially raise prices by bidding on their own items using different accounts.

    "It would be of great use to a buyer to be able to run a search on the seller and see if there appears to be shill bidding activity on the sellers account," she said.

    Warning: Strange 1-cent auctions
    On the subject of bidding, eBay users should know about the increased prevalence of "feedback groups," designed to artificially inflate scores through a series of fake low-priced auctions – many listing items for sale a 1 cent each. The groups buy items from each other essentially for free, and give positive feedback ratings to each other. Baldwin says this is common among cooperating criminals. But sometimes, unwitting accomplices are taken along for the ride.

    That's what happened to Larry Harris, an economics professor at the University of Southern California and former chief economist at the Securities and Exchange Commission. Harris' eBay account was recently hacked somehow, and in one day his impersonator won 13 auctions by bidding 1 cent or 5 cents for items that were essentially worthless, such as an electronic book. Positive feedback had already been given by the time Harris noticed the action, changed his password and regained control of his account.

    "When I looked at sellers, I saw thousands of feedback," Harris said. "People are clearly using some kind of automated system to do these frauds."

    Baldwin said the case should serve as a warning to eBay users that they need to beware of sellers who have gained their reputations from sale of such low-priced items.

  • Gift cards: Why cash is still better

    Consumers don't lose every battle against sneaky fees. In the case of retail store gift card fees, it's time to claim victory -- just in time for holiday shopping. So-called dormancy fees -- where gift cards leak value over time if they're not used -- have just about become a thing of the past. You can thank several consumer advocate agencies, along with widespread consumer disgust, and perhaps a pang of corporate consience, for the change. Most retail gift cards will never expire or lose their value now, a welcome change.

    Of course, the fight against fees is far from over. Bank gift cards, like the ones available from Visa and MasterCard, are still a terrible deal. Later in this column, I'll show you how a $50 bank card will cost you $60 and could easily be worth only $40 to the recipient.


    And you should know retail stores that have eliminated fees haven't done so entirely out of the goodness of their own hearts. Dormancy fees are peanuts compared to the money retails stores are making from gift card "breakage" – the unspent balances on cards that sit tucked away in wallets and sock drawers. A recent survey shows that the average U.S. adult has two gift cards gathering dust bunnies in dressers across America. About half of us have at least one unused card. I'll bet you do. So before you gift wrap a gift card this season, give some serious though to who the recipient will ultimately be: your loved one, or a retail store's corporate headquarters?

    First, the good news. The Montgomery County, Md., Office of Consumer Protection is the final word on gift card fees. For the past four years, the agency has conducted a comprehensive survey of gift card policies, exposing unfair expiration dates and dormancy fees. Three years ago, the survey indicated that half of the top retail cards came laden with such fees. But this year, only three of the top 40 cards have expiration dates (Bloomingdale's, Macy's, and Blockbuster). And the trend is headed in the right direction – both Toys R Us and Red Lobster expired their expiration fees in October.

    "(The fees) are coming close to being a thing of the past," said Evan Johnson, the author of the study. He credited a set of state laws banning certain fees and an aggressive enforcement action by the Federal Trade Commission against the owner of Red Lobster restaurants for failing to properly disclose the fees.

    Great odds for the company
    So there's one less thing to worry about when you give a gift card this season. But when you do, you should know that odds are 1 in 10 that the money you give will be going directly to the company instead of the recipient.

    There is a lot of money at stake in the gift card business -- $80 billion will be spent on the cards this year, according to Tower Group. And its data suggests that 10 percent of that money, about $8 billion, will never be spent, something known in the industry as "breakage." The amount of breakage is so significant that some analysts have suggested it contributed to lackluster holiday shopping sales figures the past two years. Retailers can't book the revenue from gift card sales until the cards are redeemed (or expire), so the bottom-line benefits card sales are postponed. According to Deloitte, $18 billion was spent on the cards during the 2005 holiday season, and $2.5 billion of it hadn't been redeemed by the end of January 2006. That's a lot of suspended revenue.

    Breakage is so valuable that last year Home Depot was able to claim $43 million extra in revenue from unredeemed gift cards, for a one-quarter earnings-per-share bump of 4 cents. Why irritate consumers with dormancy fees when breakage contributes that much to the bottom line?

    In some states, unclaimed property rules called escheat laws give state governments a legal claim to this unspent money. Don't think retailers haven't noticed. Deloitte says they are rapidly moving gift card operations to states like Ohio and Washington, where escheat laws are more favorable. It's not clear which state laws apply on nationwide gift cards, so there's bound to be some bickering over all that money. No matter how it turns out, you should know there's a good chance your gift will never actually be given to the recipient.

    All this is rather amazing when you consider that cold hard cash has no expiration date, will not end up in a smelly sock drawer, and certainly won't end up as a donation to a company's bottom line some day. And yet, social conventions prevent us from giving cash when we don't have time or inclination to select a genuine gift. Instead, we give plastic. This entire $80 billion a year business -- and the gift of $8 billion a year to retail stores -- is born out of this social convention.

    Money in the bank's bank
    One last note about the other gift cards in the gift-giving universe: Bank-issued gift cards. They might seem a bit more thoughtful, as recipients can use them anywhere. But beware: Bank gift cards will be in the first class when the Sneaky Fee Hall of Fame is built. All the cards cost an extra up-front fee for buyers (MasterCard's Good2Go card costs $9.95 -- meaning a $50 gift card will cost you $60). Most of the cards ding the recipient a buck or two for each transaction, for examining balances, for withdrawing cash at ATMs, and even sometimes for not doing anything at all in a given month. Bank gift cards used for multiple purchases quickly fall to $40 or less in value – and by the way, they all expire, meaning they all become worthless at a certain point. A bank gift card is the least thoughtful gift of all. And yet, TowerGroup says $23 billion will be spent on bank gift cards this year, and the Network Branded Prepaid Card Association (bank card PR agency) says one in five U.S. consumers plans to buy at least one this holiday season.

    If you or someone you love is in danger of buying one of these crazy cards, please offer to help. A greeting card store near you will gladly show you the section with the money holders.

  • Avoid the 'gotchas' of online shopping

    Online holiday shopping will again break records this year, with buyers expected to purchase more than a quarter of all their gifts online, according to the National Retail Federation.

    That means online criminals also are anticipating a record haul this year, particularly from Newbies. Fraudsters love Newbies.


    During the holidays, many folks who rarely use computers take the electronic shopping plunge for the first time, and they are ripe for picking by the crooks.

    Perhaps you know all about how to keep yourself safe online, but maybe there's someone in your life who doesn't -- someone who might try to buy something from a con artist's Web site or who doesn't know about the sneaky fees often attached to gift cards.

    This is a good time for a few helpful reminders, and perhaps this video can help.

    Hard data on online fraud rates is hard to come by, and some of it is an outright exaggeration. The National Cyber Security Alliance – a consortium of online companies -- issued a press release in November saying that one in 10 Internet users "could become a victim of online fraud this year." Even I have a hard time believing that figure. But I'm sure the problem is massive; I can tell from all the e-mails I receive from online victims.

    I know many wise Net users think, "Who would ever fall for a phishing e-mail?"

    You' be surprised. Millions of people have. And the holidays are the easiest time for phishers to strike, because online sites are sending millions of legitimate e-mails to consumers, making it even harder than normal to tell the difference between real e-mail and a fake ones.

    With legitimate e-mails confirming purchases or letting shoppers know that their items have shipped flooding inboxes, it's easy for criminals to mimic them and trick recipients into offering up personal information.

    That's just one way criminals can ruin holiday season. There are plenty more. So if you or someone you love could use a quick refresher course in online shopping safety, watch the attached video, with help from NBC producer Andy Gross, editor Ed Eaves, and graphics artist Corey Hall.

    Then have a safe shopping season.