‘Phishing’ is when attackers send scam emails which often contain malicious attachments, links to malicious websites, or ‘social engineering’ content to persuade the recipient to disclose sensitive or personal information. Although the motivations of the attackers can vary, they are generally aiming to obtain login credentials, financial details, or infect systems with malware.
Sometimes this will only affect individual systems, however it is increasingly common for attackers to target organisations where they can affect multiple systems and deploy ‘ransomware’, which could potentially affect many university systems and render them unusable.
How to Spot a Phishing E-mail
A typical phishing e-mail will have several tell-tale signs that you should be aware of, including:
-
Sender address in 'From' field is spelt wrong or does not match sender name. Often, they impersonate co-workers and the sender name may say ‘Martin Jones’, but the sender address may be ‘martin.jones123@gmail.com’, rather than an official '@staffs.ac.uk' address
-
Vague subject line, and content which creates a sense of urgency, or demands that an action is taken quickly. They often make statements that are time limited, e.g. ‘Your account has expired, click here to renew it immediately’, or ‘You only have 24 hours left to claim this offer’ etc.
-
Generic or non-personalised greeting (Dear Outlook User, Hello Amazon Customer, Greetings Account Owner, etc.)
-
E-mail asks you to disclose personal or sensitive information (username, password, address, date of birth, bank account/PayPal details, etc.)
-
Embedded links which, when hovered over, point to a suspicious site. Sometimes the links point to domains that look similar at first glance, but are not the legitimate domain – for example, micros0ft.com (with a zero) instead of microsoft.com
-
Generic signature or no contact information (System Administrator, Account Manager, PayPal Team, Apple Support, etc.)
-
Suspicious QR codes (known as ‘Quishing’). QR Codes are a quick way to share links, attackers will send e-mails including QR codes which (when scanned with a mobile device) will direct to malicious websites. If you are in any doubt regarding the legitimacy of a QR code, do not scan it
-
Compromised e-mail chains. If someone you have previously contacted someone who has since had their e-mail account compromised, you may then receive unexpected e-mails from them out of the blue. Please consider if the e-mail is unexpected or references an old conversation, or if the tone of the e-mail seems unfamiliar. If in doubt, contact the sender using an alternative contact method to verify the legitimacy of the e-mail
Poor spelling, grammar and punctuation can also be a sign of malicious e-mails, however attackers are now known to use AI applications (such as ChatGPT) to create convincing phishing e-mails. Whilst phishing e-mails with poor spelling do still exist, this can no longer be relied upon as a common indicator.
Examples of Phishing E-mails
Below are some examples of typical phishing e-mails that we have receive within the university:
Special attention should be paid to the sender’s e-mail address as this may not correlate to the sender name. This is a common tactic where the sender name will attempt to spoof a legitimate service. (e.g. the university's IT team in the above example). They have also included a sense of urgency (‘set to expire today’).