*This information is adapted from the National Cybersecurity Alliance

What is phishing?

Phishing is when cybercriminals use fake emails, social media posts, or direct messages (the bait) to try to get you to click on a bad link or download a malicious attachment, usually by gaining your trust or creating a sense of urgency. If you click on a link or download an attachment in a phishing attempt, you could give your personal information to cybercriminals, download malware, or other compromising consequences. This page focuses especially on email-based phishing, but the tips will apply to all mediums of delivery.

How do you spot a phishing attempt?

Most phishing attempts will have a few telltale signs, regardless of their delivery method (for examples of email in specific, go take a look at some of our past Catches of the Day). Here are some questions to ask yourself when you get a suspicious message.
– Does it have an offer that’s too good to be true?
– Does it use language that’s urgent, alarming, or threatening?
– Are there lots of spelling and/or grammar mistakes, or is it written strangely?
– Is the greeting very ambiguous or generic?
– Is it asking for personal information?
– Does it stress an urgency to click on a link or attachment? Does the link or attachment have a suspicious name, or one that does not match what it is claiming to lead to?
– Is it an unusual or abrupt business or school request? Were you expecting a message regarding what it talks about, or is it out of the blue?
– Does the email address match the company it’s coming from? Check especially for slight mispellings (ex. vasar.edu instead of vassar.edu), incongruencies between name and signature, wrong email domains.

Sometimes it can be hard to spot a phishing email, but other times it will be very obvious. Make sure to take a critical eye to any message to receive asking you to perform some action, and ask yourself these questions.

I got a phishing attempt! What now?

The most important thing when it comes to phishing attempts is to NOT INTERACT. Do not click on any links, download any attachments, or even respond to the email. Here’s the steps you should follow.

If the phishing attempt was sent to your Vassar email, forward it to catchoftheday@vassar.edu! It will be posted on this website so that others won’t fall for it. If you receive it on another centrally-managed email, such as a work email, you can inform the IT manager or security officer that you received a suspicious email. Some email platforms will also let you report phishing attempt. Here’s how to do this on several email clients:
Outlook
Gmail
Mac Mail

You can also report phishing attempts to the Federal Trade Commission, who keep track of larger patterns of fraud: https://reportfraud.ftc.gov/

Next, you can block the sending address do that you don’t get more phishing attempts from them. Here’s how:
Outlook
Gmail
Mac Mail
Yahoo Mail

Lastly, and most important, delete the message. Even if you do none of the steps above, make sure you do nothing to the message but delete it. As long as you haven’t interacted with the message, you’ve successfully avoided a phishing attempt.

I fell for a phishing attempt!! What do I do?

Firstly, don’t panic! There are several actions you can take to protect your information, depending on how far you went in the phishing attempt and what it had you do. We’ll go over some actions here, but see our page on recovering from phishing attempts for a more full breakdown.
– If you just clicked on a link, just close the page and do nothing else. You likely are fine, but it’s possible malware has been downloaded. Monitor your device’s behavior, and talk to the CIS Desk or another tech support service if you suspect something is wrong.
– If you filled in a form, change your password and any other information you may have provided and can change. Again, you can talk to CIS if you suspect your Vassar information has been compromised, or the respective company associated with other compromised information.
– If you fear someone has gotten into your account, first change your password, then check if anything has been obviously edited. This can include checking your sent folder in your email, making sure no documents or emails have been deleted (you can check the Trash folder on most services to see this). If any information has been sent or shared from your account, you can reach out to those affected to let them know that you were not the source of this information.