automatic payments. Clicking on any of the links takes you to a sign-in page that, again, appears to be the real McCoy. Some of the links on this page, such as for those who may have forgotten their password, actually take you to AT&T's own site. But if you fill in your user name and password and click "log in," nothing seems to happen. In fact, you've just handed access to your AT&T account to scammers. AT&T's Kasselman said that by accessing a customer's online account, the phisher will gain access to that person's full name, address, phone number and email address (but no financial info). The phisher will also be able to see the numbers and businesses you call frequently. "This can provide a road map for additional fraud," Kasselman said. The AT&T email was even more insidious because it arrived in people's in-boxes on the same day the company's actual billing reminders were sent out. Kasselman said phishers pay attention to such things and time their attacks for maximum credibility. How can you keep these guys at bay? First, always make a habit of double-checking the sender's email address whenever you get a message that invites you to submit information. That generally means holding your cursor over the links. In the case of the AT&T email, the sender's address appears as AT&T Online Services. But holding your cursor over the link reveals that it came not from AT&T's "att.com" domain but from an unrelated website. Similarly, the links