With the interactive scenarios based on real details below, you can put yourself in the shoes of someone struggling with a phishing attack. Think through how each person could have handled the situation differently. Consider if you might be vulnerable to a similar scam.
With the provided questions and answers for each scenario, you'll learn what to watch out for and how to protect yourself.
Gilly is an IU employee. Today she has back-to-back meetings. While checking emails on her phone, she sees an email from the “Employee Portal” prompting her to confirm payment for a medical procedure immediately.
She clicks on the link and is taken to a site that looks much like IU’s Central Authentication Service (CAS) login page—except that the form didn't seem to behave the same as usual when entering her username and passphrase.
Gilly submits her IU login details and is then redirected to a strange page. She is suddenly distracted when the organizer of her next meeting walks by, and she forgets about the message.
Before expanding the below sections, write down your responses for yourself. Then compare your answers.
Gordon is a new manager-level employee at IU. One week after starting his position, he receives an email that appears to be from “The IT Support Center” which requires that he verify his “company password” is strong enough as a new employee.
The email has a link that takes Gordon to an IU-branded page with a form to enter his email address and password so it can be verified. Gordon wants to make sure his passphrase is strong, so he fills out the form.
Connected to his position, Gordon has already been added to a Box folder that contains restricted institutional data.
Before expanding the below sections, write down your responses for yourself. Then compare your answers.
Garmin is an IU graduate student in his final year. He receives a message that seems to be from the head of his department, recommending he attend an upcoming event.
He clicks the “Register” link, which results in a “page not found” notice on an unknown website.Garmin doesn’t realize that by clicking the link, a keylogging malware application was installed on his computer. Later, from that same computer, he makes some online purchases.
Before expanding the below sections, write down your responses for yourself. Then compare your answers.
Now that you have practiced your responses, let's add to your skillset.
The following email examples show you various ways scammers use email lures to get victims to click or take other action, by impersonating trusted services or people.
The purpose in showing these various ploys is to help you recognize the potential threats and how varied scam attempts can be.
This is an example of a spear phishing email, designed to impersonate a person of authority requiring that a banking or wiring transaction be completed. The request is designed to be urgent to prompt action without thinking.
Image source: edts.com blog article "15 Examples of Phishing Emails from 2016-2017"
This email impersonates a financial institution requiring that an invoice be paid.
Image source: edts.com blog article "15 Examples of Phishing Emails from 2016-2017"
This phishing email impersonated Amazon, requiring immediate action in order to receive a refund. Notice several punctuation errors in the text. When hovering over the URL, you would also see a URL domain that was designed to look legitimate, but was not an actual Amazon domain.
Image source: https://www.komando.com/happening-now/367273/top-story-amazon-phishing-email-could-lead-to-ransomware-attack
This email makes the recipient concerned about (fake) recent international activity on their account. The email contains a link to review the activity, but the link was not legitimate.
Image source: Phishing.org
This email impersonates Netflix, a popular video streaming service, and requires that the recipient click the link to restart a membership. This was a very sophisticated phish, mimicking the service's brand and all the way through to a scam site that collected payment details.
Image source: edts.com blog article "15 Examples of Phishing Emails from 2016-2017"
This email impersonates an authority at the company and requires that sensitive information is sent to a third party (a fake accounting firm). While you might not have access to W-2 forms, consider other data you have access to that could be requested by a spammer. Investigate all requests for data extremely carefully and use only approved ways to share sensitive institutional data.
Image source: edts.com blog article "15 Examples of Phishing Emails from 2016-2017"
