Identifying Phishing in Departmental Accounts
Departmental accounts may regularly receive sensitive data, such as medical records, administrative and billing information, or data portal links from external contacts — particularly clinics, hospitals, and external vendors. Cybercriminals can compromise third-party accounts and use them to send malicious messages that mimic routine interactions. Use this guide to identify phishing attempts before interacting with links or attachments.
Know the Signs
| How it shows up | Common red flags | What to look for |
|---|---|---|
| Unusual activity from trusted accounts | Email comes from a real external contact’s address, but the tone or request is unusual or unexpected. | A routine contact suddenly asks you to click an unusual link, call an unrecognized phone number, or enter a passcode. |
| Suspicious links, portals, and document collaboration | Generic button labels (e.g., "Open File", "View Secured Doc") that, when hovered over, reveal a redirect to an unrecognized domain or URL. | Hovering over the link shows unexpected URLs, such as unexpected document portals or generic unrecognized domains that may host a phishing page. |
| Executable files and downloads | Prompting download of software rather than attaching standard PDFs or images, or providing the files through a trusted online portal. | File extensions on attachments that include: .msi, .exe, .zip, or an unexpected portal link. |
| Urgency and access codes | Messages insisting on immediate action or providing temporary "access PINs" to open files. | Language pressuring you to act fast to avoid account lockouts or record deletion. |
Before you click or download
- Hover over links and buttons: Hover your mouse over any button or link to inspect the destination web address. If it leads to an unfamiliar destination, do not click.
- Verify mismatched sender info: Check if the sender's display name matches their actual email address. Be cautious if a message claims to be from a local hospital but originates from a generic email domain (e.g., @gmail.com).
- Separately verify unusual emails: If a record transfer looks unusual or prompts you to download a software client, contact the sender directly via a trusted, known phone number — not the number listed in the suspicious email.
- Check for hidden file extensions: Be cautious of files named with double extensions (e.g., PatientRecord.pdf.exe or Download.pdf.msi).
Report suspicious email to University Information Security
- Do not interact: Do not reply, click links, open attachments, or enter credentials on linked web pages.
- Report suspicious emails: If you suspect that an email is suspicious, forward it to University Information Security ([email protected]) and mark the email as spam.
- Immediate response if clicked: If an attachment was downloaded or executed (e.g., ScreenConnect or installer files):
- Immediately disconnect the computer from the network (unplug Ethernet / turn off Wi-Fi). Do NOT power off the machine, as this can affect forensic evidence.
- Report the incident immediately to University Information Security ([email protected]) and your department supervisor.
- Notify department account users: Warn colleagues who access the same shared account, not using the affected account, to ensure no other colleagues interact with the message.
Intended Audiences
Do-It-Yourself Resources
Good Practices
Phishing is a common scam tactic to trick you into revealing sensitive data by visiting a fraudulent website, opening an infected document, or logging in to "validate your email account."
Resources
Report suspected information security incidents immediately to University Information Security (UIS) and do not use the device or system that may be involved in a suspected security incident or data breach.