Technology Services

Phishing

What is phishing?

Phishing scams are typically fraudulent email messages appearing to come from legitimate enterprises (e.g., your university, your Internet service provider, your bank). These messages usually direct you to a spoofed web site and ask you for private information (e.g., password, credit card, or other account updates). The perpetrators then use this private information to commit identity theft.

An example of a phishing attempt is an email message stating that you are receiving it due to fraudulent activity on your account, and asking you to "click here" to verify your information.

How do I avoid phishing scams?

Avoid phishing scams by never clicking links included in email messages from questionable sources. If you feel the message may be legitimate, go directly to the company's web site (i.e., type the real URL into your browser) or contact the company to see if you really do need to take the action described in the email message. Alternatively, copy and paste the URL from the message into your browser rather than clicking it. Delete the email message from your Inbox, and then empty it from the deleted items folder to avoid accidentally accessing the web sites it points to.

Always read your email as plain text. Phishing messages often contain clickable images that look legitimate; by reading messages in plain text, you can see the URLs that any images point to. Moreover, when you allow your mail client to read HTML or other non-text-only formatting, attackers can take advantage of your mail client's ability to execute code, which leaves your computer vulnerable to viruses, worms, and Trojans.

How do I report phishing attempts?

You can send details to the Anti-Phishing Working Group, which is building a database of common scams to which people can refer.

Information supplied courtesy of Baylor University and the Indiana University UITS Knowledge Base.