I received a rather alarming email today from what appeared to be PayPal, confirming an iPod purchase that I never made. I get well over 100 spam and phishing emails every day, but I confess this one made me blink.

This email was not from PayPal, but they wanted me to believe it was. "Hey, wait a minute!" I cried not quite aloud. "I didn't order any iPod!"

Of course I hadn't. And I had not been charged for any iPod. This was yet another tactic in the world of phishing, and I could only groan at how many innocent people will be suckered by it. It happens all too often.

Many readers will already know about phishing:

Phishers attempt to fraudulently acquire sensitive information, such as passwords and credit card details, by masquerading as a trustworthy person or business in an electronic communication. Phishing is typically carried out using email or an instant message, although phone contact has been used as well. Attempts to deal with the growing number of reported phishing incidents include legislation, user training, and technical measures.

The best way to deal with phishing is to recognize it when you see it. And here, your mouse is your friend. The answer is hidden in the links within the email.

If I'm not sure about the identity of the sender, and cannot dismiss the email out of hand -- e.g., I don't have a Wells Fargo account or eBay account, thank you very much -- I mouse over the link -- don't click* -- and see where it really links to.

Here, in this screenshot, I can see that the link takes me to some website called kiesz.com. (Note: Where the link is revealed differs between email programs. If the link doesn't pop up when you mouse over the link, you might see the link down in the status bar of your email program at the bottom.)

I'm not fooled by the http://www.google.com in the url -- that's just a trick to make you think the url is "safe," but Google will just redirect you to the pernicious site ... which will look real (but won't be).

If you do happen to click to the site, whatever you do, don't type in your private information! Instead, go to the institution's actual website and start there. For example, if the email was seemingly from PayPal, manually surf to paypal.com and type in your information there.

What is really dangerous (and imho evil) about these PayPal scams is that, in most cases, the thief will be able to get in and drain hundreds or thousands of dollars from your account before you notice. The same goes for personal banking accounts.

So whenever you encounter what smells like a phish, let your mouse check it out and avoid what could end up being a bear of a problem.

Happy Holidays!

*If you click, then the phisher/spammer will have confirmation that your email address is valid, and will be able to sell it to other phishers and spammers, and you'll only get more and more of this garbage in your in-box.

Laura Scott blogs on her business site, pingVision, and her personal blog, rare pattern.