Tips to avoid becoming a victim of a Phishing attack

After observing a recent increase in the number of phishing attacks on ONID email accounts we wanted to produce this guide to help you spot phishing emails. There are specific things that only apply to ONID and oregonstate.edu email accounts, but most of the information can be used for any email you recieve.

What is Phishing?

Phishing is an attempt by a person or organization to gain information such as usernames, passwords or credit card information. Once the unauthorized person gathers this information, they can use it to fradulently purchase items on YOUR credit card, send real or spam e-mail from YOUR e-mail address, or sign up for services in YOUR name. The Phishing site on Wikipedia has more information if you are interested.

Actions you should take to avoid becoming a victim

• NEVER give your password to ANYONE, including technical support personnel.
• NEVER respond to spam messages, that validates your address to the spammer and your e-mail address will be FLOODED with SPAM.
• Read the email critically and ask yourself some questions.
  • Does it make sense?
  • Is the capitalization, grammar, puncutation and sentence structure, correct?
  • Is the email too generic?
  • Why are they asking for my personally identifiable information over an unsecure method of communcation, such as e-mail?
  • Why would the administrators of that system need my username, which they already know?
• Never respond to an email requesting this information.
• Forward suspicious emails to your support group or call the agency requesting the information; E.g. Bank of America, OSU Federal Credit Union, Computer Helpdesk, etc.
• Never click on links or images in suspicious emails.
• Abide by the OSU Acceptable Use Policy you signed, especially the section: "Accounts and passwords may not, under any circumstances, be shared with or used by persons other than the individual(s) to whom they have been assigned by the University."
• Don't chat up scammers. Read a transcript from a real scam artist to gain further insight.
• If you are still unsure what to do, contact your computer support group on campus.

Common things to look for

This is an example of a phishing email and specific items to look out for.

1. Reply address is misspelled and to the wrong email domain

The reply email address will almost always be different from the person that appears to be sending the fradulent e-mail. This is because the person trying to get your account information is hoping you will hit reply and not notice who the email is actually being sent to. If you did respond to one of these emails and realize it later you should change your password immediately.

2. ONID doesn't have anonymous registration

This is specific to just ONID accounts, but any e-mail address that required prior registration information from that organization is NOT "anonymous registration." No email service will ever send you an e-mail stating your account will be deleted unless you respond with account information! If you are unsure about the e-mail server you are using and think they may do something like this, either call or send a email directly to the support team e-mail that is on the website to ensure that it doesn't get sent to a fradulent individual.

3. We will never ask you for your password, birthday, country, or GAP.

No technical support or e-mail provider should ever ask for any personal information, especially passwords. If you have NOT contacted your e-mail or internet provider for help, be very suspicious of any email you receive claiming to be technical support, because tech support should not contact you unless you have asked for help.

4. Conflicting Information

Many times automated messages are created by pulling different sections of text out of a database and often times the information that gets pulled for the email has conflicting information. Of course both propositions of having your account disabled or deleted in 48 or 24 hours is scary and causes many people to act too quickly. ONID will notify you of account deletion or deactivation at least a couple weeks before anything is done. If an email gives you a deadline within hours or days the chances of it being a scam greatly increase.