Phishing is an attempt to obtain sensitive information such as username, passwords and financial information.

Phishing is normally carried out using email spoofing, messaging and social media platforms and tricks you into parting with personal information or sending you to a fake web site.

Email Spoofing

This is when you receive what looks like a legitimate email from a financial organisation, your IT department or social media sites such as Facebook and Twitter.

They will normally use scare tactics or the prospect of a reward to get you to part with your details or visit a malicious web site designed to steal your information.

Examples of phishing emails


Example of fake web site

 

These fake emails and web sites are designed into fooling you that they are legitimate but if you enter your login credentials they will simply steal them.

 

How to spot some obvious phishing email behaviour

Some phishing emails display more obvious mistakes or characteristics:

  • Generic greetings (Dear customer) rather than specific to the individual
  • Poor spelling and grammatical errors
  • Request for passwords, PINs, personal information (Date of Birth, Address, social security numbers or passport details)
  • Any offer seems to be ‘too good to be true’
  • Unexpected delivery notes, workplace issues (including password expiry advisories, account updates and information claiming to be from HR, technical issues).
  • Subject matter tends to prey on the individuals, curiosity, fear (your account has been compromised or suspicious activity has been noticed) or sense of urgency (account to be closed if you don’t respond within 24 hours etc.)
  • Have an attachment which the email wants you to open (delivery note, invoice etc.) or a link it wants you to click

 

What to do with them

  • If you have not responded or clicked a link/opened an attachment – simply delete them
  • If the suspect email seems particularly targeted against you – report it to the information security team as it may indicate a targeted attack.
  • Never reply to any email asking for your passwords, PINs or other account details.
  • Don't open attachments unless you completely trust where they have come from.
  • If in doubt contact the organisation the email is reportedly being sent from, using a trusted phone number. Obtain these numbers by going to either the official web page of the organisation or from any documentation previously received. The majority of organisations will be prepared for these types of calls due to the rise in phishing and public concern of identity theft.

 

What to do if you responded to them (replied or clicked a link)

  • Change your password immediately
  • Report it to the ITCS Service Desk giving as much detail as possible, including the suspect email. This will help ITCS take action hopefully to prevent others within the University falling victim to the same phishing attack.
  • If you think you may have compromised the safety of your bank details and/or have lost money due to fraudulent misuse of your cards, you should immediately contact your bank, and report it to Action Fraud.
  • If the phishing attack is related to student finance, an example should be forwarded to phishing@slc.co.uk in addition to reporting it to Action Fraud.