Stop Phishing Attacks
UWSUPER.EDU/TECHNOLOGY
This phishing training by the UW-Superior Office of Technology Services was modified from text provided by the UW System Office of Information Security, February 2022.
MORE THAN 90% OF DATA BREACHES START WITH A PHISHING ATTACK.
Email is an essential part or our everyday communications. It is also one of the most common methods that hackers use to attempt to gain access to sensitive information.
Common Phishing Attacks
Account Verification The email appears to come from a well-known company, like Instagram, and asks you to sign in and correct an issue with your account. TIP: Do not click any links in the email. Directly log in to your account by typing the address into your web browser. If you are unable to log in, contact the service using official contact information.
Cloud File Sharing The email contains a link to what appears to be a shared file on Google Docs, Dropbox or another file-sharing site. TIP: Do not click any links in the email. Instead, log in to your account and find the shared file by name. Remember to verify sender identity and use established Cloud file sharing services. Learn how you can do this process on OneDrive.
Docusign The message comes from a domain similar to the DocuSign domain. The link in the email will prompt you to sign in to view the document, giving attackers control of your inbox. TIP: DocuSign never attaches items to email — attachments are likely malicious. Instead, access documents directly at www.docusign.com.
Fake Invoice The email contains a document presented as an unpaid invoice and claims service will be terminated if invoice is not paid.This tactic targets individuals (by pretending to be a retailer) or businesses (by impersonating a vendor or supplier). TIP: Do not reply to the email. Contact the vendor/service directly using official contact information before submitting payment.
Delivery Notification The message appears to come from a popular delivery service (FedEx, UPS, etc.) or online retailer and includes a delivery notification with a malicious link or attachment. TIP: Do not click links or open attachments in unexpected delivery notifications. Instead, visit the delivery service's official website and enter the tracking information or call the delivery service's official phone number.
Tax Scam An email appears to come from a government tax revenue agency. It claims you are delinquent on your taxes and provides a means to fix the issue before additional fines or legal actions are pursued. TIP: Never share personal or financial information via email. Only use official communication channels to contact government agencies.
Phishing is an attack designed to steal money (both from individuals and from businesses) as well as private data, by getting access to personal information (such as credit card numbers, bank information, or passwords) on websites that pretend to be legitimate. Cybercriminals typically pretend to be reputable companies, friends, or acquaintances in a fake message, which contains a link to a phishing website or some sort of malicious payload.
Phish or SPAM
Want your information: credit card number, password, bank account, etc.
Unwanted advertisements for products or services
Often targeted: Sent to a specific individual or group and contains relevant information, e.g., your name
Always broad: Sent to millions of recipients
Include malicious links to fake websites or malware downloads
Include links to mostly legitimate websites offering products or services
May contain malicious attachments
Does not contain attachments
Has a sense of urgency
Does not require immediate action
Should be reported then deleted
Should be marked as spam and deleted
THINGS TO
KNOW
Technology Services needs your help to keep us all safe! Cybercriminals are getting clever with their tactics, but we have ways you can stay safe. Educating yourself about these sneaky tricks will help you use email safely. Don't feel embarrassed if you think you fell victim to a criminal. These tactics are common for a reason and the criminals have some nasty tricks. Remember, part of keeping us all safe is reporting any suspicious activity immediately to the Technology Help Desk.
Email Spoofing Email addresses can be spoofed. Never trust an email simply by the purported sender. Cybercriminals use many methods to disguise emails. They trick their victims into thinking a sender is legitimate, when the email is really coming from a malicious source. The most common types of email spoofing are display name spoofing. With display name spoofing, the phisher uses a legitimate company name as the email sender, such as microsoftsupport@microsoft.com, but the email underneath is a random address like xyz@yahoo.com. Display name spoofing is most effective when a user views the email on a mobile device, because the sender’s email address is hidden. Phishers count on the fact that most users will not expand the sender’s name to view the email address.
Threatening or Enticing Subject lines and text are often threatening or enticing. Cybercriminals may promise a "free iPhone,” threaten that “your credit card will be suspended,” or "your computer has been hacked" with links to fake tech support. Evoking a sense of panic, urgency, or curiosity is a commonly used tactic. Users are typically quick to respond emails that indicate potential financial loss or that could result in personal or financial gain. Emails that have an aggressive tone or claim that immediate action must be taken to avoid repercussions should be considered a potential scam.
Glaring Errors Phishing emails are getting more sophisticated. Employees need to read their emails carefully, not just skim them. Many phishing and spear phishing attacks are launched from other countries. As a result, many phishing awareness training sessions instruct users to look out for glaring grammar and stylistic issues.
Deceptive Links Links aren’t always what they seem. Every phishing email includes a link, but phishing links are deceptive. While the link text might say “Go to PayPal account,” the URL takes the user to a phishing page designed to look like PayPal. Make sure that you hover over all links before clicking them to see the pop-up that displays the link’s real destination. If it is not the website expected, it's probably a phishing attack.
Phishing Links Hidden in Attachments All phishing emails contain a link, but links are not always in the email. To avoid detection by email security filters, hackers will include a phishing link in an attachment, such as a PDF or Word doc, rather than the body of the email. And because sandboxing technology scans attachments for malware, not links, the email will look clean. The email itself will appear to be from a legitimate business, vendor, or colleague, asking you to open the attachment and click on the link to review or update information. During phishing awareness training, users should be trained to hover over links in attachments in the way they do when inspecting links in emails.
Using Real Brand Images Hackers use real brand images and logos. Brand logos and trademarks are no guarantee that an email is real. These images are public and can be downloaded from the internet or easily replicated. Even antivirus badges can be inserted into emails to persuade victims into thinking an email is from a legitimate source.
Asking for Gift Cards It is a huge red flag if you are asked to buy a gift card. Scammers often will ask you to purchase gift cards. Credit cards have protections put in place, but gift cards are like giving cash. Once they are given you will not be able to get your money back.
[STOP] Text Message Attacks
Are scammers blowing up your phone? Be suspicious of texts. Unwanted texts are designed to trick you into acting without thinking. Texts may look like they are coming from a real number or email, but if you didn't innitiate the text it likely is a scam. Remember the common phishing tactics and these tips. Don't reply. This includes replying "STOP." People are now accustom to unsubscribing from text messages with replying "STOP" so scammers add this to their texts. Only reply to a text message that you know is legitimate. Ironically, replying "stop" might cause you to be targeted with increased unwanted messages, because it shows the number is active. Do be careful with your private information. When setting up accounts only give as much information as necessary. Never provide private details through text message or email. It is not secure and a real organization will not ask you to do so. Don't click on texted links and instead visit trusted websites directly. Opening links and attachments is dangerous. For example, instead of clicking on a texted link to check on the status of a delivery go directly to the FedEx or UPS website with your verified tracking number.
Do contact your cellphone carrier for help with any suspicious activity. Your cell phone provider can advise you on how to block these calls and add antivirus protection. Keep an eye on your phone bill to make sure scammers are not using your number to send out their messages. Do report unwanted texts. Report spam texts to your phone company so they can investigate. Norton compiled a list of how to report spam texts to various providers in their article How to Stop Spam Texts: 8 Do's and Don'ts (Oct. 1, 2020). Report to the Federal Trade Commission: https://reportfraud.ftc.gov If related to UWS, contact the Technology Help Desk: https://www.uwsuper.edu/technology/
Note: If you happen to have a University of WisconsinSuperior owed cell phone please contact the Help Desk for additional support options.
How to Report Phishing? Contact the Technology Help Desk Immediately.
Location: Swenson Hall 2100 Email: helpdesk@uwsuper.edu Phone: 715-394-8300 Regular Hours: 7:45AM – 6:30PM Monday – Friday Break/Summer Hours: 7:45AM – 4:30PM Monday – Friday Remember to never forward suspicious emails to anyone except to helpdesk@uwsuper.edu. Note: There also is the option to add a reporting feature to Outlook. If you would like this enabled contact the Technology Help Desk.
TECHNOLOGY HELP DESK LOCATION: SWENSON HALL 2100 EMAIL: HELPDESK@UWSUPER.EDU PHONE: 715-394-8300