Phishing Scams
Phishing scams are designed to trick you into revealing sensitive personal information (e.g. passwords, credit card numbers, Social Security Number), which in turn can be used for fraud or identity theft. Phishing typically takes the form of an e-mail message that appears to come from a trusted organization (e.g. your bank, the University), but is actually from the identity thieves.
The university will never ask for information such as Social Security Number, your
date of birth or password in an e-mail message.
Do not respond to any e-mail that asks for personal information.
The Essentials
- Do not send sensitive information in e-mail. This includes passwords, credit card numbers, birth dates, etc.
- Beware of links in e-mails - especially when the page you land on asks for sensitive information. Check the address bar to ensure that you're on the site you think you're on. When in doubt, open a new browser window and type the URL of the site you want to visit, and then follow links to the page you want to access.
- Never assume that an e-mail came from the person you think it came from. When in doubt, call the sender on the phone or contact the Technology Service Desk at servicedesk@shu.edu or (973) 275-2222.
How-to recognize phishing e-mails or links
A few clues can help you spot fraudulent e-mail messages or links within them.
What does a phishing e-mail look like?
Phishing e-mail messages are designed to steal your identity. They ask for personal
data, or direct you to Web sites or phone numbers to call where they ask you to provide
personal data.
Phishing e-mail messages take a number of forms:
- They might appear to come from your bank or financial institution, a company you regularly do business with, or from your social networking site.
- They might appear to be from someone you know. Spear phishing is a targeted form of phishing in which an e-mail message might look like it comes from your employer, or from a colleague who might send an e-mail message to everyone in the company, such as the head of human resources or IT.
- They might ask you to make a phone call. Phone phishing scams direct you to call a customer support phone number. A person or an audio response unit waits to take your account number, personal identification number, password, or other valuable personal data. The phone phisher might claim that your account will be closed or other problems could occur if you don't respond.
- They might include official-looking logos and other identifying information taken directly from legitimate Web sites, and they might include convincing details about your personal information that scammers found on your social networking pages.
- They might include links to spoofed Web sites where you are asked to enter personal information.
To make these phishing e-mail messages look even more legitimate, the scam artists may place a link in them that appears to go to the legitimate Web site (1), but actually takes you to a phony scam site (2) or possibly a pop-up window that looks exactly like the official site.
Here are a few phrases to look for if you think an e-mail message is a phishing scam.
"Verify your account."
Businesses do not ask you to send passwords, login names, Social Security numbers,
or other personal information through e-mail.
If you receive an e-mail message from Microsoft asking you to update your credit card
information, do not respond: this is a phishing scam.
"You have won the lottery."
The lottery scam is a common phishing scam known as advanced fee fraud. One of the
most common forms of advanced fee fraud is a message that claims that you have won
a large sum of money, or that a person will pay you a large sum of money for little
or no work on your part. The lottery scam often includes references to big companies,
such as Microsoft. There is no Microsoft lottery.
"If you don't respond within 48 hours, your account will be closed."
These messages convey a sense of urgency so that you'll respond immediately without
thinking. A phishing e-mail message might even claim that your response is required
because your account might have been compromised.
What does a phishing link look like?
Sometimes phishing e-mails direct you to spoofed web sites. Here’s an example of the
kind of phrase you might see in an e-mail message that directs you to a phishing Web
site:
"Click the link below to gain access to your account."
HTML-formatted messages can contain links or forms that you can fill out just as you’d
fill out a form on a Web site.
Phishing links that you are urged to click in e-mail messages, on Web sites, or even
in instant messages may contain all or part of a real company’s name and are usually
masked, meaning that the link you see does not take you to that address but somewhere
different, usually an illegitimate Web site.
Example of a masked Web address
Con artists also use Web addresses that resemble the name of a well-known company
but are slightly altered by adding, omitting, or transposing letters. For example,
the address "www.shu.edu" could appear instead as:
- www.shu.com
- www.shu.edu.au
- www.verify-shu.edu