Phishing is the use of email and fraudulent websites to trick people into disclosing personal financial or identity information, such as credit card or Social Security numbers, user names (e.g., NetIDs), passwords and addresses. Although most "phishes" come as email, phishing scams can also come in the form of text messages and phone calls. It's called "phishing" because the criminals are broadcasting phony emails to large numbers of addresses, and they're hoping the recipients will "take the bait." The emails will either try to entice you with promises of great deals or scare you into providing the information.

Phony emails are sent from addresses across the Internet and appear to be from reputable organizations, but are not. The emails are actually from criminals who are attempting to lure you to provide your personal information. Often both the emails and the web pages they direct you to look just like you would expect to see from that organization since the logos and formats have been copied. The message uses social engineering tactics that might indicate there is a problem with your account and urges you to respond immediately by clicking a web link to "verify" or "update" your account information.

It's important to note, that the company that is being spoofed has nothing to do with the scam. Their name is just being used to trick you into "taking the bait."

What are some examples of phishing?

If you receive an email soliciting confidential information such as your password, Social Security Number, credit card number, or other sensitive information, with instructions to send it via email, this is likely a scam. Email messages travel over the Internet in an insecure manner, and you should never send sensitive information in an email. Notre Dame will NEVER request you provide this information via e-mail. You can view some sample phishing scam messages in the OIT Phish Bowl.

How to Recognize Scams

Scam tactics are increasingly sophisticated and change rapidly. Even if a request looks genuine, be skeptical and look for one or more of these warning flags:

• The message is unsolicited and asks you to update, confirm or reveal personal identity information (e.g., full SSN, account numbers, NetID, passwords, protected health information).
• The message may indicate it is sharing a document with you, but you weren't expecting a document, and there is little information about what that document is.
• The message creates a sense of urgency.
• The message may have an unusual "From" address or an unusual "Reply-To" address instead of a recognizable "@nd.edu" style address.
• The message indicates that your ND email account has or is about to exceed your storage quota. (ND Google quota is unlimited)
• The (malicious) website URL doesn’t match the name of the institution that it allegedly represents.
• The web site doesn’t have an "s" after "http" (for example, https://) indicating it is not a secure site
• The link in the pop-up doesn’t match the printed text. (hover your mouse over the link to view it)
• The message is not personalized. Valid messages from banks and other legitimate sources usually refer to you by name.
• There are grammar or spelling errors.

How to Report Scams

To report a scam to Google and the OIT to aid us in blocking further messages from the sender, follow these instructions.

Note: there is more specific information about COVID-19 related phishing scams here: How to avoid online scams related to the coronavirus (COVID-19)