Cybersecurity Awareness Month Week 4: How to spot phishing
Phishing remains one of the most common and effective types of cyberattacks. Cybercriminals use carefully crafted emails to impersonate trusted organizations or individuals, hoping to trick you into revealing sensitive information, clicking on a malicious link, or opening a dangerous attachment. While phishing emails may look convincing, there are always warning signs if you know what to look for.
Lookin’ Phishy
- Unexpected Requests: Be cautious of emails that ask you to download and install an invite, share personal data, or click on links you didn’t ask for or are not relevant to you.
- Urgency or Threats: “Act now”, “your account will be closed”, or “if you didn’t authorize this payment, call us asap” are common tactics used to trick you into taking a hasty action.
- Suspicious Links: Hover your mouse over any hyperlink. If the web address looks odd or doesn’t match the sender, don’t click.
- Mismatched Email Address: Even if the display name looks familiar, double-check the actual sender’s email. Look for small spelling changes or free email services where a known organization’s domain should be. For example, if someone says they’re emailing on behalf of the campus but are sending from a regular gmail address? That’s a red flag.
- Too Good to Be True Offers: If an email offers a bunch of free stuff, but you just have to give them your payment information for shipping and handling– that is an indicator you’re going to be scammed out of whatever you pay and never receive the proposed item.
- Unexpected Attachments: Attachments from unknown or unusual sources should be treated with extreme caution.
Polished Language Can Be Deceptive! It was once good advice that spelling, grammar, or formatting errors served as a warning sign of phishing. While that is still sometimes true, modern tools like AI chatbots make it easier for scammers to craft messages that are virtually error-free and written in a format. Don’t rely solely on language quality to determine whether an email is legitimate. Look for red flags in the context and tone to tip you off.
“I’m Doing My Part!”
It can be tempting to just delete a suspicious message and move on, but reporting it does much more. All emails reported using the “Report phishing” option in Gmail (three dots in the upper right corner of the message) will create a ticket directly with IT and contribute to Google’s spam and phishing detection.
If you’re unsure whether an email message is legitimate, verify with the supposed sender using a separate trusted method like calling their number or talking to them in person—not by replying to the suspicious email. Taking even a few moments to pause and confirm can prevent significant harm to you or the college.
Phishing works because it preys on trust and emotional reactions. By staying alert, recognizing the signs, and reporting suspicious messages, you help defend not only yourself but the entire campus.
For more details on how to report phishing, check out 1 Minute on How to Report Phishing. (https://stolaf.hosted.panopto.com/Panopto/Pages/Viewer.aspx?id=532464aa-0223-4e12-a9c6-ac590103f243)
Go deeper on this topic by checking out the resources found here. https://www.staysafeonline.org/articles/phishing
Remember…
About phishing simulations.
We’ll conduct two phishing simulations for students in October and November. Phishing simulations for employees will continue at the monthly cadence we started in the spring. As always, if you see unusual or suspicious emails, report them as you would any other spam or phishing messages. Your vigilance keeps our community safer.
Get your cybersecurity training done.
We aim for all faculty, staff, and first-year students to complete Cybersecurity 101 by the end of the month. It doesn’t take long! Employees who complete the training by the end of October will be entered into a drawing for a $20 Bon Appétit gift card. Separate courses for students and employees can be found in Moodle.
Our online Cybersecurity Town Hall is on October 26.
Join Kendall George, information security officer for Carleton and St. Olaf Colleges, at our annual Cybersecurity Town Hall: Cybermaxxing to Securitymog the Ops. This engaging, interactive session will describe the current state of cyberthreats in higher education and the steps you can take to keep both campus and your own digital life secure. There will be ample time for questions and answers.
Stay safe out there.
Phi Anderson
Security Analyst
Carleton and St. Olaf Colleges