Cybersecurity Awareness Month: Avoid Phishing Attacks

Phishing

Phishing is the use of deception to acquire passwords, credit card numbers, or other sensitive information from a user. There are many phishing mediums including SMS messages (Smishing), voice calls (Vishing), and email which is the most common phishing medium. Within emails, users should be wary of malicious URLs or attachments.

Phishers typically pose as a trusted entity, such as a system administrator or service provider, in order to scam their victims. Often, these messages will ask for the user to communicate in some other means; for example, a message may request that a victim send an SMS message to a specific number or reply using a personal email address. These messages will also imply some sense of urgency for the request, thus leading an unsuspecting victim to react quickly without first asking themselves whether or not the message is legitimate.

Recent examples of phishing scams at UMBC: 

• Fake job offers 

• Google forms requesting usernames and passwords

• Gift card scam 

To spot phishing emails, look out for the following:

Unexpected messages making unexpected requests

Does this email or direct message come from an unfamiliar sender who claims to know you, or a friend who you have not spoken to in a long time? Does the list of recipients contain people you don’t know or talk to? This is particularly true if the message asks for money or personal information.

An urgent tone

If the sender says you must act now and uses fancy jargon or other intimidating language, ask yourself why.

An offer that’s “too good to be true”

It probably is, especially if important information like an employer’s address or a product’s shipping information is nowhere to be found.

Phishy Links and Email Addresses

Hyperlinks and sender emails appear to correspond to known domains and people, but something, sometimes a single letter, has been changed. This may require close examination; look for misspellings, dashes, or other deviations from what seems to be a legitimate domain.

Valid name, but strange domain in email address

For example, UMBCPayroll@gmail .com, umbcpresident@yahoo .com, or financialaid413@hotmail .com

An email requests your password, your credit card number, or other sensitive information

Email is never secure for sharing this type of information, and most trusted services should already have it. On sites that ask you to provide personal information like your credit card, look for “https” in the address bar to ensure the site is secure. UMBC will never request your password in an email.

Request for a cell phone number

In many recent phishing messages, the hacker requests that you send them your cell phone number so that they can ask you a question.  Why would a legitimate person needing assistance not just ask you the question in the email message, rather than asking for your phone number?

A prompt to open an attachment or follow a link

Critically examine any email with an attachment, especially an unexpected one. If the link prompts you to “Sign In” to an account, be extra suspicious. Do not “Enable Macros” or allow similar permissions for attachments you do not trust.

The time zone/send time of the message is unusual

For example, why would a member of the University community be sending a message with a time zone that is appropriate for Eastern Europe?  Is it suspicious for a UMBC community member to send an email message at 3 am?

Something “off”

Phishing emails often have an impersonal, awkward, unprofessional, or out-of-character tone. Many - but not all - phishing emails contain conspicuous typos, bizarre capitalization, strange grammar, or numbers used in place of letters.

Report

If you have any questions about whether or not the mail you've gotten is legitimate, please contact the DoIT Security Department at security@umbc.edu.