How to catch a "phish"
Have you ever had a phishing email worm its way into your inbox? Did you catch it right away? Delete it? Report it? Perhaps it seemed legitimate so you responded or followed a link.
Phishing is an attempt to obtain information by disguising as trustworthy or legitimate messages, such as email, text, phone calls, computer popups, or other common communication methods. Phishing scams can appear to come from anyone, such as “UMN Edu Team,” “Service,” “HelpDesk,” “Customer Service,” “IRS Collections,” or even a colleague or friend.
Security is a shared responsibility
Falling victim to a phishing message doesn’t just endanger your personal information (such as giving a scammer your password if you log in to a fabricated sign-in page), but it potentially exposes all of the University data you may have access to as a student, staff, or faculty member. Information like grades, personal information like phone numbers and addresses, patient data, donor details, and more could be at risk if you are not wary of potential phishing scams coming your way. Keeping the University secure is a shared responsibility between all of us - staff, faculty, students, and the University. But how can you tell the difference between a phishing email and regular correspondence?
What do phishing messages look like?
Phishing emails are often designed to look as legitimate as possible, and cyber scammers sometimes do their homework and add in specific details to help you trust the message. For instance, phishing messages targeted to the University of Minnesota sometimes feign to come from President Gabel or other recognizable figures.
Other warning signs of phishing messages include:
The email may include threats of dire consequences if you don't act quickly.
The content might include poor spelling, grammar, or formatting that looks unprofessional.
It could include a link to a login page that may look like the University's login page, or could be shortened by services like tinyURL or bit.ly.
The message may ask you to open a shared document you may not be expecting.
- Remember, the University will never ask you to provide your username and password via email.
To see examples of recent phishing attempts sent to to University faculty, students, and staff, visit the Phishing Blog at z.umn.edu/phishing.
Report phishing to the U
The University of Minnesota takes phishing very seriously. Did you know there is a specific email address to report phishing attempts? It’s [email protected]. The University Information Security team receives these messages, responds accordingly, and also routinely tracks and reports on recent phishing attempts to hit the University on their phishing blog. This is a great resource to check against if you think you have received a phishing email to your University account. University Information Security can take your reports of attempted phishing and potentially take action against the sender, like blocking them or notifying the whole University of a potential threat.
If you think you have received a phishing message to your University account, take these 3 steps:
Do not reply to the message or click on any links.
Forward the email in its entirety to [email protected].
Delete the message from your inbox.
You may also report it to Google as spam in your inbox.
What if I replied to the message?
If you think you have responded to a phishing scam via email, change your University password immediately. To make resetting your password easier, visit z.umn.edu/passwordreset now and set up your password reset questions.
Taking a few seconds to give a closer look to the email you just received may help you to identify it as a potential scam. Noticing this before responding might save you a big headache in recovering your personal information, or protect the University against a potential data breach. We need your help to identify phishing attempts at the University because after all, security is a shared responsibility!