Not so long ago, email scams mostly came from generous "millionaires" kindly seeking our assistance. While these emails annoyed, they didn't cause much trouble because most of us smell a rat when a rich stranger offers to share loads of cash with us.
Today, however, many scams arrive in our inboxes under the guise of official university business. Some sport the university mark. Some take us to phony web pages that look just like the AccessPlus or Blackboard login. It's all too easy to be fooled into accidentally giving up personal info on these fake sites.
This visual shows suspicious signs of phishing scams in a sample email. Download here.
To help thwart identity thieves, we need to become more adept at spotting the sophisticated fakes in our inboxes daily and more active in reporting suspicious email to information technology services staff. Here are some tips from ITS staff on spotting and stopping scammers.
Don't trust any email that seeks user names, passwords or personal info
Iowa State units won't ask you for your user name, password or other personal info via email.
Scrutinize the "FROM," "TO," and "CC" fields in email addresses
A telltale sign of a scam is a personal email address (for example, janedoe@hotmail.com) in the "FROM" field of an email coming from a well-known business or organization. It's also suspicious if a lot of names or email addresses that you don't recognize appear in the "TO" or "CC" fields.
Don't access ISU services via email
Be wary of email that directs you to ISU services, such as the AccessPlus, Outlook and Blackboard login sites. The safe way to access these services is from the university homepage.
Don't click links, attachments or downloads, unless you're sure
Unless you're sure of the sender's identity, don't click. Links, attachments and downloads in email can be used to install malware on your computer. If you hover over a link, the link's true destination should pop up. If the real destination doesn't match the message link, don't follow it.
Keep your operating systems, antivirus software and browsers up-to-date
Some scams use viruses or holes in the security of popular operating systems, like Windows and Internet Explorer, to get into your system.
Report suspicious email promptly to abuse@iastate.edu
If you receive suspicious email on your ISU account, forward it promptly to ITS at abuse@iastate.edu. If the email turns out to be a scam, ITS staff will take these steps:
- To protect those reading mail on campus, ITS blocks the domain from which the scam came. Once the domain has been blocked, it doesn't matter if you're lured into clicking a nasty link. You'll simply be redirected to an ITS site warning that you just dodged a malware bullet.
- Unfortunately, the domain block won't work if you're reading email at home or anywhere else off-campus. That's why ITS staff always contact the host provider for the malware-bearing site and submits a "take down" request. If you're off campus when you click on an email scam link, you're OK if the host provider has already complied with the request. You'll simply see a "not found" message. However, if the host provider hasn't fulfilled the "take-down" request (and that's often the case), you'll need ITS assistance to deal with the aftereffects of that unfortunate click.
