Week 1 - Recognizing and reporting phishing

Cybercriminals sent over 3.3 billion phishing messages and caused over 4,000 data breaches, exposing over 22 billion personal records. But it is not enough to simply know that phishing emails exist. You also need to be able to recognize and report them.

Look at some of the highly used phishing email types and tactics

Reward or "free gift" message

Free things are enticing, but they can also be dangerous. If you get an email saying you won a free TV or "click here to enter a prize drawing," be on high alert! Hackers are trying to bait you into selecting a malicious link.

Login or password message

Another type of phishing email asks you to verify your account by logging into a (fake) webpage or updating your credentials. These emails can collect your username and password, giving a hacker instant access to your account.

Urgent message

An urgent phishing email is designed to get you to act fast. It might tell you that your account was hacked or will be deactivated — click here to restore it! Fear makes people do things without thinking, so slow down!

Internal messages

Hackers will try to impersonate people at TAMU-CC:

• Human Resources department: They scare you into believing something is wrong with your employment or health safety. They may tell you to visit an unusual website to verify your information or receive health information. They may give you a malicious file attachment (e.g., Word or PDF document) that supposedly answers some urgent questions or could ask for personal information.
• Information Technology: They scare you into believing your account is disabled for unknown reasons or you have been locked out of an application. They may tell you to go to an unusual website to recover what they claim you lost. Or they may give you a malicious file attachment (e.g., Word or PDF document) that supposedly has instructions for recovering your access. Account-related activities will all be through My IslandID, so you can ignore these messages.
• President or other organizational leaders at TAMU-CC: They tell you they need your specific and urgent assistance on something, like buying gift cards or getting your cell phone number. To make you think you should not verify who it is, they may also claim they cannot come to the phone because they are in a meeting. If they are texting your cell phone, you cannot confirm who it is, and the university cannot block them from contacting you directly. Think about it: Would the President really feel like they could not stop a meeting and call you directly? And do you usually buy gift cards for the President?

If you think you may have encountered a phishing email, forward the email to security-incident@tamucc.edu. Once the Office of Information Security is notified, they can help you determine if it is a phishing email. Whatever you do, do not click on any links, open any attachments, reply to the email, or send it to anyone else!