Not quite sure how to spot a phishing attempt or how to distinguish it from spam email? Keep reading for more information.
So what is phishing?
It's an attempt to get you to give up sensitive information.
A phishing email looks like it comes from a trustworthy organization. It tries to get you to submit information like your username, password, credit card details, or other sensitive information.
It used to be easy to spot a phishing email. You could pretty much count on bad grammar, poor spelling and too-good-to-be-true offers.
Not so, anymore.
These days, lots of phishing attempts have gotten more sophisticated. Sure, you’ll still see some that fall into that old, easy to spot style. But more and more of them look professional. Because more and more phishing scammers are getting professional, spending real money to fool you, just as a professional fisher spends money on good bait. Read more about phishing at Wikipedia.org
Check the Bait.
In this case, the bait is any email you receive. A simple phish will try to create anxiety, typically saying something like there is a problem with your account and asking you to reply to the email and provide your username and password so they can resolve the problem. Those are easy to spot. Trickier phishes include a link (often disguised) that will take you to a webpage where you will be asked to complete a form. The trickiest ones are crafted to look just like an official notification from UW. They use our logo, often capture language used in previous official emails, and are "signed" by real departments or people.
You may also see phishes that pretend to be from a bank or other online business.
Remember, if an email makes you feel that you need to take action immediately, be suspicious. Also know that IT support people will never ask you for your password. If there was a problem with your account, we would call you if we have a phone number or we would email and ask you to call us. These instances are rare and will never be resolved over email.
If an email makes you suspicious, but you're not sure it's phishing, call the sender and ask if it's legitimate. Be sure to use a number you already have or one you can look up, not the one provided in the email.
Recent Developments: Did you know that phishing isn't limited to just email? You may receive a phone call using the same anxiety creating techniques. Don't give any personal information, such as your full social security number (you may need to verify your identity with the last 4 digits), credit card or bank account numbers, health insurance information, or passwords over the phone. UWIT will NEVER ask for your password.
Examples of strong wording include:
- IMMEDIATELY
- NOW!
- YOUR ACCOUNT WILL BE TERMINATED
- ALERT
Hover over the spot
In this case, the spot is a link in the email. When you place your cursor over that link and hover without clicking, the actual link will be shown, usually at the bottom of the window. In a phish you'll find that this link really goes to a different site than is shown in the link text. Check that link carefully -- the bad guys will frequently include portions of the authentic address to try to fool those who know the hover trick. Make sure that you inspect the entire address: if the portion before the first / in the address (after the http://) doesn't have uwyo.edu, don't click!
You can also hover using a mobile device. Simply touch the link and hold it. A window will pop up asking what you will want to do -- at the top of that window will be the actual link.
Be especially wary of URL shortening services such as tinyurl.com and bitly.com, since hovering doesn't work on them.
Try it out! Hover over the spot.
How's this different from Spam?
Spam email, another type of unsolicited email, is typically advertising. The sender of a spam message wants to get you to visit a website where they'll receive a small compenstation for every visit. Their goal is to get as many people to visit as possible, so they flood a network with thousands of email messages, hoping a few people will click on it.
You've seen lots of them: advertisments for pharmaceutical products, bargain hotels, special deals on travel -- if you can think of it, someone has sent a spam email about it.
Spam isn't just annoying though; often the websites linked in a spam email contain malicious software like viruses and adware. It is best to avoid them altogether.