Note: My Web pages are best viewed with style sheets enabled.

Recognizing and Responding to Hoaxes

Copyright © 1999-2002, 2004, 2008, 2010 by David E. Ross

Reconizing Hoaxes

E-mail created a revolution in personal communication. If I receive something interesting, I can forward it to my friends. Unlike postal mail, I do not have to retype a message or make copies; I do not have to address envelopes. If I want to send a message to several individuals, I do not need to make a series of phone calls (possibly waking a relative or interrupting a friend's dinner because I forget the difference in time zones). Of course, this also means that distributing a lot of foolishness is much easier.

Hoaxes and frauds have been around for a long time. E-mail merely makes the spread of such misinformation easier and quicker. One problem is that there is no simple method to determine if a message is real or a hoax.

One of the surest clues that a warning is actually a hoax is that it does not contain sufficient details about its origin to allow you to obtain further information from an authoritative source. Something happened someplace (not specified) to someone (unnamed) recently (but when?). However, some hoaxes do contain such specific details (e.g.: A Long Pay from Home).

You have been warned about a computer virus or some new criminal activity. How can you tell a good warning from a bad one? The CIAC (Computer Incident Advisory Capability) at the U. S. Department of Energy had an excellent Web site (no longer existing) that discussed hoaxes, described many common examples, and gave some sound advice on how to distinguish them. The points presented there included:

Hoaxes often say: "Tell your friends. Send them E-mail immediately, or call them." This means that individuals who are not professionals experienced in dealing with computer security are spreading the news. Legitimate warnings come directly from such professionals. Indeed, they come from a professional associated with the computer service or network that you use; or they come from a recognized authority such as US-CERT at the U.S. Department of Homeland Security, the CERT Coordination Center at Carnegie Mellon University, or other members of FIRST. Obviously, an E-mail message that has already been forwarded and forwarded again before reaching you is a hoax.
Legitimate warnings generally include the digital signature of their originators. This permits the recipients to authenticate the source and also to verify that the message has not been altered.
Any warning citing the Federal Communications Commission (FCC) as the source — or any other agency that is not a member of FIRST — is a hoax. In 1995, the FCC explicitly stated: "The U.S. FCC does not disseminate information regarding the existence, impact, or affect of computer virus."
Other well-known organizations that do not issue virus warnings include AOL, MSN, Micro$oft, and CNN.
Hoaxes sound reasonable and contain technical terminology. However, they often describe pending disasters that are impossible. No virus can cause your computer to belch smoke or otherwise damage your hardware. Some hoaxes describe how certain versions of software are particularly vulnerable to a virus; too often, no such version of the named software ever existed.
An unopened E-mail message or attached file cannot spread a virus, even if it is not deleted. (Executing or unzipping a file involves opening it.) A warning to delete messages immediately is generally a hoax.

Reading about examples of hoaxes might also help to create the appropriate skepticism. The Urban Legends Reference Pages is an excellent resource for studying urban legends whose origins are still unknown (thus the designation legend for these hoaxes). There, you can see the analysis used to debunk some wild (and some not so wild) claims. They reproduce the complete text of some widely circulated E-mail messages that are entirely fraudulent; then they carefully dissect each message to make the hoax clear. Also, you can read my own analyses of hoaxes that have been attempted against me.

Be careful! After you become sufficiently skeptical, you might become too skeptical. Legitimate warnings about fraud or other criminal threats (or about computer viruses) are sometimes presented with hyperbole and a disregard for facts, making them appear to be hoaxes. Nevertheless, the threats are real and should be heeded (but only after an analysis of the truth behind them).

Responding to a Hoax

When you receive a message from a friend that is a hoax, you should do your friend a favor. Help him or her to avoid future embarrassment: Let your friend know when he or she has been victimized by a hoax, and explain how to recognize hoaxes (possibly by including a link to this page in your reply). Don't compound the current embarrassment, however, by sending this reply to everyone who received your friend's warning. After all, he or she was merely trying to help or protect you.

Updated 21 February 2010