Phishing

Phishing is a way of attempting to acquire information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in an electronic communication. Communications purporting to be from popular social web sites, auction sites, online payment processors or IT administrators are commonly used to lure the unsuspecting public. Phishing is typically carried out by email spoofing or instant messaging, and it often directs users to enter details at a fake website whose look and feel are almost identical to the legitimate one. Phishing is an example of social engineering techniques used to deceive users, and exploits the poor usability of current web security technologies.

  • Example of AU-related Phishing Scam
  • Warning Signs

    There are often signs that can tip you off that a message may not be what it appears. The hints below can help you avoid "taking the bait."

    • Urgent Language - Phishing attempts often use language meant to alarm. They contain threats, urging you to take immediate action.  “You MUST click on the link below or your account will be canceled.”
    • The Greeting - If the message doesn't specifically address you by name, be wary.   Fake messages use general greetings like “Dear eBay Member” or “Attention Citibank Customer” or no greeting at all.
    • URLs Don’t Match - Place your mouse over the link in the e-mail message.  If the URL displayed in the window of your browser is not exactly the same as the text of the link provided in the message, run.  It’s probably a fake.   Sometimes the URLs do match and the URL is still a fake.  Before you click, look for other clues in the message like the use of a secure connection (SSL – https://).
    • Avoid the Obvious- “Official” messages that contain misspellings, poor grammar and/or punctuation errors are dead-giveaways – assume those are fake.  And, of course, if you don’t have a Wachovia credit card, for example, don’t respond to a request for information for card holders!
    • Request for Personal Information - If an e-mail message asks you to provide your user name, password, or bank account information by completing a form or clicking on a link within an e-mail message, don’t do it.   Legitimate companies will never ask you to provide that kind of information in an e-mail message.  Most legitimate messages will offer you an alternate way to respond like a phone number.
  • How to Avoid Them

    OIT and other legitimate agencies will never ask you to provide personal information like user name or password via an e-mail message. If you receive such request, do not respond. Instead, report it! Forward that message as an attachment to abuse@auburn.edu. Reporting these messages will help OIT block it's spread at the university firewall level. Once you've forwarded the message to OIT you should delete it from your inbox. If you receive an e-mail message that appears to be suspicious, trust your instincts and do not respond.

    While some legitimate messages may contain a link, it is best to err on the side of caution. Instead, go directly to the company's website or contact them by phone to see if you really do need to take any action. Most legitimate messages will offer you an alternate way to respond like a phone number. You can always request confirmation of any message appearing to be from OIT by contacting the OIT HelpDesk at (334) 844-4944 or helpdesk@auburn.edu.

    In general, you can protect yourself by following these simple guidelines:

    • Use antivirus software on your computer. AU students and employees can download it free at http://www.auburn.edu/download.
    • Keep your computer's antivirus, spyware, browser, and Windows security patches up to date.
    • Use a browser that has a phishing filter.
    • Monitor your credit card, banking and personal accounts regularly and investigate unauthorized activity.
  • Use the Microsoft Phishing Filter
    If you use Internet Explorer as an internet browser you should enable the Phishing Filter. This feature enables a portion of the web browser to change colors to signify that the page you're on is a known phishing site. Read more about it here: http://www.microsoft.com/protect/products/yourself/phishingfilter.mspx
  • Links and References

    For avoidance tips, more info and examples try these sites:

  • Report Phishing Attempts

    You can report these phishing scam attempts to the company that's being spoofed.

Last Updated: Jan. 22, 2011