Phish Out of Water: Be Phish Smart

Phishing is a form of social engineering that leverages emotions and urgency to get someone to provide account passwords, financial information, or other personal information. Cybercriminals will often seek to gain this information by acting as a trusted or authoritative source, lowering the guard of their potential victims.

Phishing campaigns targeting the University community

Throughout 2026, cybercriminals have been increasingly targeting University community members and students in phishing campaigns. Common phishing scams can include:

• Fake account and login requests
• Research sharing inquiries
• E-Vite (electronic invitation) messaging
• Job fraud

Phishing emails may direct users to a fake Google login page or to a Google Document or Site that links to a convincing but fraudulent University of Minnesota login page. This page is designed to steal passwords and multi-factor (Duo) authorization, which allow the attacker to use the account to further propagate their attack.

The URL of the fraudulent Google or UMN login are page is not a legitimate. UMN login pages will include login.umn.edu in the URL, and Google login pages will contain accounts.google.com. Email recipients should confirm the legitimacy of the login page by checking the page URL in the browser’s address bar, especially while following links on mobile devices.

How to protect yourself and identify phishing

Suspicious URLs

You may see websites that look legitimate but are actually spoofed websites. 

• When you receive a suspicious email, forward it to [email protected].
• Be cautious of any generic “Account Notice” emails sent to your account.
• Be aware of slight misspellings in email addresses or domains (i.e., rnicrosoft.com instead of microsoft.com).
• Hover over hyperlinks with your cursor or long-press hyperlinks on mobile to see where you’ll actually be sent.

Review email links

Always review links in emails before clicking; long-press or hover over links to view the URLs they’re pointing to.

• URLs for all University-related websites should end in umn.edu. 
• While the display name of the sender may look correct, display names and email addresses can be spoofed.
  • Contact the sender directly or through a trusted communication channel.
  • Use Google to search for a person/company website before responding.

Review email sender

Especially when on mobile devices, double-check that the name of the sender makes sense with the email address of the sender.

• Mail from what appears to be a legitimate account from another University, even sometimes from a UMN account, may be fraudulent if the account is compromised.
• If you have never been contacted by this email address in the past, be extra cautious when interacting with any links or attachments.
• If you have been contacted by this email address before, but the email itself is unusual (e.g., E-vite invitation, email asking you to click links when that doesn’t usually happen, etc.), we recommend sending the message to [email protected] for expert analysis.

Verify URLs

Always check the page URL in your browser’s address bar before entering your login information into University login pages.

• The URL for the University’s primary login page is login.umn.edu.
• Some University applications use Microsoft for single sign-on. That login page is login.microsoftonline.com. 
• The URL for Google’s log in page is accounts.google.com. 

Identify malicious attachments

If you download a file directly or from a malicious link, perform a Google Security Checkup to sign out of any unrecognized devices or remove unauthorized third-party apps, such as SOAX, ngrok, or AdsPower.