This month’s scam is a recent and widespread phishing attack that attempted to use social engineering and impersonation to gain account access. This one is particularly tricky, but it uses a very common set of steps that criminals deploy to steal account credentials.
- The user receives the suspicious email, in this case from an ‘@wustl’ address.
- The attacker instructs the recipient to follow a link to a fake portal.
- The recipient enters credentials in the fake portal unknowingly revealing them to the attacker.
- The recipient verifies their account using second-factor instructions contained in the original phishing email.
If you see a message like the one below, please don’t interact with any links or follow any special instructions regarding authentication methods. Simply report it using the Phish Alert Button (PAB) in your Outlook interface. You can find more information about the PAB and alternative reporting methods at the link below. It’s always best to err on the side of caution and report anything that seems remotely suspicious. Our team will analyze all submissions and return them to you if they’re determined to be safe.
Guidance for Reporting Phishing
Phish Alert Button (PAB) | Office of Information Security | Washington University in St. Louis
Below, we dissect this phishing attempt to reveal the many red flags that it contains. Bad punctuation is circled, semantic red flags are in ovals, and grammar problems are underlined in the example email below.
- Response to unanticipated request.
- Asks recipient to follow a link in an email.
- The unexpected sender instructs the recipient to authenticate 2FA using a specific method.
- Grammar and punctuation errors: “on phone!”.
- The signature is not consistent with an authentic WashU IT email.
- The signature has a period at the end.
Criminals will often generate fake portals like the one used in this scam (pictured below) to capture your credentials. The most sophisticated attackers can very closely mimic authentic portals.
Avoid this scam and other phishing scams by following our ten phishing safety tips and related guidance below.
10 Phishing Safety Tips
- Don’t click. Instead of clicking on any link in a suspicious email, type in the URL, or do a search on wustl.edu for the relevant department or page. Even if a website and/or URL in an email looks real, criminals can mask its true destination.
- Be skeptical of urgent requests. Phishing messages often make urgent requests or demands. When you detect a tone of urgency, slow down and verify the authenticity of the sender and the request by using official channels, rather than the information provided by the sender.
- Watch out for grammar, punctuation, and spelling mistakes. Phishing messages are often poorly written. Common hallmarks of phishing are incorrect spelling, improper punctuation, and poor grammar. If you receive an email with these problems, it may be a phishing attempt. Double-check the email address of the sender, don’t follow any links and verify the authenticity of the request using official channels.
- Keep your information private. Never give out your passwords, credit card information, Social Security number, or other private information through email.
- Pick up the phone. If you have any reason to think that a department or organization really needs to hear from you, call them to verify any request for personal or sensitive information. Emails that say “urgent!”, use pressure tactics or prey on fear are especially suspect. Do an online search for a contact phone number or use the contact number published in the WUSTL directory.
- Use secure websites and pay attention to security prompts. Always check if you are on a secure website before giving out private information. You can determine whether a website is secure by looking for the “https:” rather than just “http:” in the Web address bar or for the small lock icon in the Internet browser. If your browser cannot validate the authenticity of the website’s security certificate, you will be prompted. This is frequently a telltale sign of fraud, and it would be a good time to pick up the phone or report a suspicious message.
- Keep track of your data. Regularly log onto your online accounts and make sure that all your transactions are legitimate.
- Reset any account passwords that may have been compromised.
- Know what’s happening. Visit the Office of Information Security Alerts page often and follow us on Twitter to get the latest WashU Information Security Alerts.
- Report it. If you are a victim of an email scam, report it to our office by using the Phish Alert Button (PAB). When you report a phishing attack, we will investigate it and if necessary, remove other instances of the attack from our systems. Reporting the attack will help protect others and our institution.
Additional Resources
Phishing | Office of Information Security | Washington University in St. Louis
Phishing 101 | Office of Information Security | Washington University in St. Louis