Phishing emails are an attempt by thieves to lure you into divulging personal and financial information, for their profit. They pretend to be from well-known legitimate businesses, and increasingly look as if they actually are. They use clever techniques to induce a sense of urgency on your part so that you don't stop to think about whether they are legitimate or not. Some even target a select group of users and tend to be more specific and include information more detailed and familiar to the recipient. These messages often include a request for personal information and a notification of account suspension or closure for failing to reply.
The latest wave of phishing attacks is becoming more sophisticated. These attacks gain access to an account in an attempt to collect your financial information along with other personal information. Question any message that asks you to log into a site to verify your credentials, even if it looks like the normal UCSB authentication page. If you are in doubt, please contact the UCSB Enterprise Technology Service Center (ETSC) or forward the email to firstname.lastname@example.org. Please remember, we NEVER ask you to verify your identity over email!
If you compromise your account by responding to a phish, your access to email may be turned off until the situation is resolved.
Six Ways to Recognize a Phishing Message
- Generic Greeting: For example, "Dear customer" instead of using your name.
- Sense of Urgency: May include an urgent warning requiring your immediate action.
- Account Status Threat: May include a warning that your account will be shut down unless you reply.
- Forged email address: The sender's email address may be forged, even if it looks legitimate.
- Forged links to Web sites: There is often a link to a web site to "fix" your account. These are often forged.
- Requests for personal information: Asking for login and password information, either in the email or from the link.
On the surface the sample below may appear legitimate, but closely examining it reveals that the email was not sent from a valid UCSB address.
From: Admin Center <email@example.com> Sent: Monday, May 12, 2014 4:36 PM Subject: Attention: UC Santa Barbara Webmail User Attention: UC Santa Barbara Webmail User, This mail was send by ucsb Admin Center to notify you that we have temporarily prevented access to your account. We have reasons to believe that your account may have been accessed by someone else and it was for illegal activities. Please run this file and Follow instructions: You are to send ucsb Admin Center the information below otherwise we shall block this account permanently, you must reply to this email immediately and enter your details below. Name: Login: Password: Note: that if we do not receive your reply in the next 24 hours we shall deactivate this account. "ucsb.edu Admin Center Support Team" Copyright © web Admin 2014 All Rights Reserved.
A few tips you can generally apply to email safety:
- Never send your password in an email under ANY circumstances
- If you didn't expect a message from a particular sender, especially one that you don't know personally, be extra cautious
- If you're ever unsure whether a particular message is a phish, ask your CDA or local IT support for help