Phishing Prevention
Phishing is a way of attempting to acquire information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popular social web sites, auction sites, online payment processors or IT administrators are commonly used to lure the unsuspecting public. Phishing is typically carried out by email spoofing or instant messaging, and it often directs users to enter details at a fake website whose look and feel are almost identical to the legitimate one. Phishing is an example of social engineering techniques used to deceive users, and exploits the poor usability of current web security technologies.
There are often signs that can tip you off that a message may not be what it appears. The hints below can help you avoid “taking the bait.”
- Urgent Language – Phishing attempts often use language meant to alarm. They contain threats, urging you to take immediate action. “You MUST click on the link below or your account will be canceled.”
- The Greeting – If the message doesn’t specifically address you by name, be wary. Fake messages use general greetings like “Dear eBay Member” or “Attention Citibank Customer” or no greeting at all.
- Place your mouse over the link in the e-mail message. If the URL displayed in the window of your browser is not exactly the same as the text of the link provided in the message, run. It’s probably a fake. Sometimes the URLs do match and the URL is still a fake. Before you click, look for other clues in the message like the use of a secure connection (SSL – https://).
- Avoid the Obvious- “Official” messages that contain misspellings, poor grammar and/or punctuation errors are dead-giveaways – assume those are fake. And, of course, if you don’t have a Wachovia credit card, for example, don’t respond to a request for information for card holders!
- Request for Personal Information – If an e-mail message asks you to provide your user name, password, or bank account information by completing a form or clicking on a link within an e-mail message, don’t do it. Legitimate companies will never ask you to provide that kind of information in an e-mail message. Most legitimate messages will offer you an alternate way to respond like a phone number.
ITS and other legitimate agencies will never ask you to provide personal information like user name or password via an e-mail message. If you receive such request, do not respond. Instead, report it! Forward that message as an attachment to help@muw.edu. Reporting these messages will help ITS block it’s spread at the university firewall level. Once you’ve forwarded the message to ITS you should delete it from your inbox. If you receive an e-mail message that appears to be suspicious, trust your instincts and do not respond.
While some legitimate messages may contain a link, it is best to err on the side of caution. Instead, go directly to the company’s website or contact them by phone to see if you really do need to take any action. Most legitimate messages will offer you an alternate way to respond like a phone number. You can always request confirmation of any message appearing to be from ITS by contacting the ITS HelpDesk at (662) 329-7287or helpdesk@muw.edu.
In general, you can protect yourself by following these simple guidelines:
- Use antivirus software on your computer.
- Keep your computer’s antivirus, spyware, browser, and Windows security patches up to date.
- Use a browser that has a phishing filter.
- Monitor your credit card, banking and personal accounts regularly and investigate unauthorized activity.
For avoidance tips, more info and examples try these sites: