By: Ryan Johnson
Below are some basic items to keep in mind to help keep your machine safe:
- Do not open or respond to emails that look suspicious or unusual, are from someone you don’t know, or that ask you to take an action, such as making a payment or giving information or credit card details. If the email claims to be from a genuine company but originated from a free web-based email service, it is likely spam.
- When using email be wary of phishing and emails that contain the following:
-
- Spelling and bad grammar: Phishing emails are commonly plagued with spelling and grammatical errors.
- Links in emails: Links in emails may appear as though they are taking you to a legitimate website however, they can be disguised. Hover over (DO NOT CLICK) links and see if you are being re-routed to some other page.
- Threats: Some emails contain threats to include legal action, time sensitive materials, etc. These are designed to convince you to make a hasty decision and click a malicious link or open an unsafe attachment.
- Spoofing a legitimate website or company: Some emails will appear to come from a legitimate company. However that is far from the case. Again, attackers will try to make everything appear to be legitimate but things such as suspicious URL’s (pages with names not associated with the website or company), or outdated information can be tell-tale signs something is not right.
- Do not open an attachment you weren’t expecting, especially if you don’t know the sender. Often malicious code masquerades as zip files or Word documents or some other file type. Scammers can easily change the .EXE extension of a malicious file to .DOC.
- Just as you should not open attachments, do not click on a link in an email unless you are 100 percent sure it is safe to do so. It is easy to interject an infected hyperlink into the body copy of an email. If in doubt, delete it, or check with the sender or the Helpdesk.
- Don’t be fooled by phishing attempts. Someone, somewhere, will try to get personal information from you. Never give out personal details over email or fill in a form that pops up when you open up an email. May times throughout the year, you may receive an email that threatens to shut down your email account unless you provide your Penn State password. Penn State will NEVER ask for your password.
- On the phishing front, you shouldn’t open or interact with messages from businesses to which you haven’t given your address and be wary of messages from companies that already have your address. A popular tool among spammers is to act as if they were from your bank, for instance, suggesting you need to change your password. In cases such as these, it is best to check the banks’ website for details or call the banks’ helpdesk to ensure your account is in order — better safe than sorry! Banks and other organizations should not be contacting you via email for security purposes.
- Never rely solely on received e-mail when asked to perform financial or other sensitive transactions. Email is not a reliable assurance of sender’s identity. If you are the recipient of a sensitive email request, insist on conducting secondary out-of-band verification via phone call or in person. As in the case of this incident, the “from” address of an email may be fake – or a sender’s account could be compromised and in the hands of a malicious actor.
- When using Two Factor authentication, don’t accept a request for 2FA unless you initiated it. Someone may have your WebAccess credentials and trying to access your data.
- When working remotely, use your work machine for work business and for work business only. For all other personal browsing and transactions, please use a home or personal device.
If you believe you have been sent a phishing scam, forward the original phish as an attachment in a new message addressed to phishing@psu.edu
