Phishing Tips
Learn to Identify Phishing
Although phishing emails are becoming more complex and difficult to detect, they are never perfect. There are a few things you can look out for that will help you differentiate between a phishing email and a legitimate one. See below to learn about each topic:
The email is sent from a public email address
- Look at the sender’s email address, as this can help identify if the person is truly who they claim to be. Often, the criminal will use a public email address such as gmail.com. If your bank or colleague is going to email you, it will come from a company email account with the company name in the email address.
Strange attachments
- If you receive an unexpected email or an email from someone you don’t know asking you to open an attachment, do not open it. These attachments can contain malware that can harm your computer and capture your personal data.
The creation of a sense of urgency
- Phishing emails often ask recipients to verify personal information, such as bank details or a password. They can create a sense of urgency by warning that your account has experienced suspicious activity or pretending to be someone you know who is in urgent need of financial help. These are massive warning signs. If you are ever unsure, contact the company or person using the contact details you already have for them or that are on their legitimate website. Never use any contact details or click any links provided in the email.
Links to unrecognized sites or URLs that misspell a familiar domain name
- Phishing emails may ask you to click a link within the email. By hovering your mouse over the link or address (or long pressing mobile devices), you can see the linked site’s true URL. These URLs can be slightly misspelled or completely different to what you are expecting, so always double check before you click.
Poor spelling and grammar
- You can often detect a phishing email by the way it is written. The writing style might be different to that usually used by the sender and it might contain spelling mistakes and poor grammar.
Protect Yourself from Phishing
Everyone is susceptible to falling victim to a well-crafted attack and it is imperative that we take precautions to decrease the associated risks. Consider the techniques below as part of your overall security strategy. See below to learn about each topic:
Be cautious about opening attachments or clicking on links in emails
- Even your friend or family members’ accounts could be hacked. Files and links can contain malware that can weaken your computer's security.
Do your own typing
- If a company or organization you know sends you a link or phone number, don’t click. Use your favorite search engine to look up the website or phone number yourself. Even though a link or phone number in an email may look like the real deal, scammers can hide the true destination.
Make the call if you're not sure
- Do not respond to any emails that request personal or financial information. Phishers use pressure tactics and prey on fear. If you think a company, friend or family member really does need personal information from you, pick up the phone and call them yourself using the number on their website or in your address book, not the one in the email.
Turn on two-factor authentication
- For accounts that support it, two-factor authentication requires both your password and an additional piece of information to log in to your account. The second piece could be a code sent to your phone, or a random number generated by an app or a token. This protects your account even if your password is compromised. As an extra precaution, you may want to choose more than one type of second authentication (e.g. a PIN) in case your primary method (such as a phone) is unavailable.
Back up your files to an external hard drive or cloud storage
- Back up your files regularly to protect yourself against viruses or a ransomware attack.
Keep your security up to date
- Use security software you trust, and make sure you set it to update automatically.
Report phishing emails and texts
- Forward phishing emails to abuse@olemiss.edu – and to the organization impersonated in the email. Your report is most effective when you include the full email header, but most email programs hide this information. To ensure the header is included, search the name of your email service with “full email header” into your favorite search engine. For more information, see IT Email Abuse & Phishing Reporting.
View recently reported phishing emails and texts
- Recently reported malicious, fraudulent, and phishing emails for awareness and to help users in the UM community stay safe by identifying them. See the frequently updated Malicious, Fraudulent, & Phishing Messages list.