Pharming is a type of online fraud that silently redirects your web browser to a fake website designed to steal your personal information. Unlike phishing, it doesn’t need you to click a bad link. The attack corrupts the internet’s navigation system so your computer sends you to the wrong destination even when you type the correct web address yourself. Federal prosecutors treat pharming as a serious crime under the Computer Fraud and Abuse Act, the wire fraud statute, and federal identity theft laws.
How Pharming Works
Every time you type a web address like “yourbank.com,” your computer has to translate that name into a numerical IP address that identifies the server hosting the site. That translation happens through the Domain Name System, or DNS. Think of DNS as the internet’s phone book: your computer asks a DNS server for the number that matches the name you typed, then connects you to it.
Pharming attacks the translation step. An attacker manipulates the DNS process so that when your computer looks up “yourbank.com,” it receives a fake number pointing to the attacker’s server instead of the real one. The swap happens before your browser ever loads the page. You see what looks like your bank’s website, but everything you type goes straight to the attacker.
The Three Main Pharming Methods
Malware That Rewrites Your Hosts File
Your operating system checks a local file called the “hosts file” before reaching out to a DNS server, treating it like a personal address book. Malware that infects your computer can rewrite entries in that file. Once it does, your browser loads the attacker’s fake site whenever you try to visit the legitimate one. The browser behaves normally throughout because it is simply following a corrupted set of directions. Modern security software like Windows Defender flags unauthorized changes to the hosts file as a potential threat, which is one reason keeping antivirus active and updated matters.
DNS Cache Poisoning
DNS servers store recently looked-up addresses in a temporary memory called a cache to speed up future requests. An attacker who manages to insert a false address into that cache can redirect every user who connects through that server, with no malware required on any individual device. Cache poisoning is particularly dangerous because it bypasses personal security measures entirely and can hit large numbers of people at once.
Router-Based Pharming
Many home and small-business routers ship with default administrator passwords that are publicly known, and their firmware may contain unpatched security flaws. An attacker who gets into your router can change its DNS settings so that every device on your network, from laptops to phones to tablets, gets redirected to malicious servers. Because the change happens at the router level, the individual devices show no signs of infection.
How Pharming Differs From Phishing
Phishing and pharming both aim to steal your login credentials, but they work differently. Phishing requires your active participation: you receive a deceptive email, text, or social media link, and the attack only works if you click. Pharming requires nothing from you beyond typing a web address you visit every day. The DNS manipulation happens invisibly, which is what makes pharming harder to catch. There is no suspicious email to tip you off.
That distinction shapes your defenses. Learning to spot suspicious emails helps against phishing but does almost nothing against pharming. Protecting yourself from pharming requires technical measures: securing your router, using encrypted DNS, and taking browser security warnings seriously.
How to Recognize a Pharming Site
Pharming sites are built as near-perfect replicas of login pages for banks, email providers, and online retailers. Because the redirect happens at the DNS level, the address bar in your browser may show the correct website name. That visual consistency is what makes pharming so deceptive. There are still signs to watch for:
- Missing or invalid HTTPS. Legitimate banking and financial sites always use HTTPS, shown by a padlock icon in the address bar. A pharming site often cannot obtain a valid security certificate for the domain it is impersonating, so the padlock may be missing or your browser may show a certificate warning.
- Browser security warnings. If your browser tells you the site’s certificate does not match the domain name or was issued by an untrusted authority, do not proceed. Those warnings are a strong indicator you have been redirected.
- Repeated login failures. The fake site may show a simulated login error after you enter your credentials, giving the attacker multiple chances to capture them. If a familiar site suddenly rejects a password you know is correct, stop and verify the connection some other way.
- Small visual differences. Look for slight changes in the page layout, unusual fonts, broken images, or links that don’t work. Pharming sites copy the login page but rarely reproduce the whole site perfectly.
How to Protect Yourself
Secure Your Router and Devices
Change your router’s default administrator password to a strong, unique one. Default credentials are one of the easiest entry points for router-based pharming. Check your router manufacturer’s website periodically for firmware updates and install them promptly, since updates close the security gaps attackers exploit. On your computer, keep your operating system and antivirus current. Modern antivirus programs monitor the hosts file for unauthorized changes.
Use Encrypted DNS With DNSSEC Validation
Your internet service provider assigns you a default DNS server, but you can switch to a third-party resolver that supports DNSSEC validation. DNSSEC adds cryptographic signatures to DNS responses, allowing your computer to verify that the address it received actually came from the authoritative server and was not tampered with in transit. Public DNS services from Google, Cloudflare, and Quad9 support DNSSEC validation and are free to use. Fewer than 10 percent of the most-visited domain names are currently signed, but a validating resolver still protects you whenever you visit a signed domain.
Turn On Multi-Factor Authentication
Multi-factor authentication adds a second verification step beyond your password. Even if a pharming attack captures your login details, the attacker cannot get in without the second factor. Text-message codes can be intercepted by sophisticated real-time pharming kits that relay your code to the legitimate site as you enter it. Hardware security keys and device-bound passkeys offer stronger protection because they verify the identity of the site itself and will not respond to a fraudulent server, even one that looks identical to the real one.
Take Browser Warnings Seriously
Check for the padlock icon and “https://” at the start of the address before entering any login credentials or financial information. Never dismiss a browser security warning about an invalid or mismatched certificate on a site you use regularly. That warning may be the only visible signal that you’ve been redirected. If you see one, close the tab and try reaching the site through a different network or device.
What to Do If You’ve Been Pharmed
Secure Your Accounts and Devices
Change the passwords for any accounts you may have logged into on the compromised connection, starting with your bank and email. Clear your computer’s DNS cache to remove poisoned entries. On Windows, open Command Prompt as an administrator and run ipconfig /flushdns. On macOS, open Terminal and run sudo killall -HUP mDNSResponder. If you suspect your router was compromised, reset it to factory settings, update its firmware, and set a new administrator password before reconnecting.
Contact Your Bank Fast
Call your bank and credit card companies immediately. Federal law limits your liability for unauthorized electronic transfers based on how quickly you report. Under Regulation E, your maximum loss is $50 if you notify your bank within two business days of learning about the unauthorized access. That cap rises to $500 if you report between two and 60 days. You could face unlimited liability for transfers that occur more than 60 days after your bank sends a statement showing the fraud, if the bank can show earlier notice would have prevented those later transfers.1eCFR. 12 CFR 205.6 – Liability of Consumer for Unauthorized Transfers Ask the bank to flag your account for suspicious activity and consider requesting a new account number.
Place a Fraud Alert or Credit Freeze
A fraud alert tells creditors to verify your identity before opening new accounts in your name. You only need to contact one of the three major credit bureaus (Equifax, Experian, or TransUnion); that bureau must notify the other two. An initial fraud alert lasts one year and can be renewed. A credit freeze is stronger. It blocks anyone, including you, from opening new credit accounts until you lift it, and it requires you to contact all three bureaus individually.2Consumer Advice – FTC. Credit Freezes and Fraud Alerts Both protections are free.
Report the Attack
File a complaint with the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov. The IC3 accepts reports from anyone who believes they have been affected by a cyber-enabled crime. You will need your contact information, details about the financial loss, any information you have about the attacker, and a description of what happened. Save or print your complaint confirmation before closing the page. It is the only opportunity to retain a copy.3Internet Crime Complaint Center (IC3). FAQ If a large transfer is still pending, contact local law enforcement directly as well.
Federal Criminal Penalties for Pharming
No single federal statute is labeled “the pharming law,” but several laws cover the conduct involved. Prosecutors choose among them based on what the attacker did and how much damage resulted.
The Computer Fraud and Abuse Act
The Computer Fraud and Abuse Act (18 U.S.C. § 1030) is the primary federal law on unauthorized computer access.4United States Department of Justice. 9-48.000 – Computer Fraud and Abuse Act Pharming typically falls under the provision that criminalizes intentionally accessing a protected computer without authorization and obtaining information from it. For a first offense committed for financial gain, which describes nearly all pharming schemes, the maximum penalty is five years in prison. A second or subsequent conviction raises that ceiling to ten years.5Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
Wire Fraud
Because pharming uses internet communications to carry out a scheme to defraud, prosecutors can also charge it as wire fraud under 18 U.S.C. § 1343. Wire fraud carries a maximum sentence of 20 years in prison. If the scheme affects a financial institution, that maximum increases to 30 years and fines of up to $1,000,000.6Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
Identity Theft
When pharming is used to harvest personal information for identity fraud, the federal identity theft statute (18 U.S.C. § 1028) applies. Producing or transferring false identification documents carries up to 15 years in prison. If the offense is connected to certain other crimes, including drug trafficking or acts of domestic terrorism, the maximum rises to 20 years.7Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
Restitution for Victims
The Identity Theft Enforcement and Restitution Act of 2008 expanded courts’ authority to order restitution in computer fraud and identity theft cases. Convicted offenders can be required to reimburse victims for the time they reasonably spent trying to repair the damage, not just their direct financial losses.8GovInfo. H.R. 5938 – Identity Theft Enforcement and Restitution Act of 2008 Victims of large-scale breaches may also receive compensation through civil settlements covering credit monitoring services and out-of-pocket fraud expenses.