Have you received an email asking for financial details, like your direct deposit information? The Division of Information Technology’s Chief Information Officer David Steinour warns email users to be careful—these messages could be fraudulent.
Phishing scams are emails designed to steal a person’s sensitive information, including passwords, bank details and credit card numbers. The George Washington University’s Division of IT is currently working on ways to make GW email less vulnerable to these attacks and keep email users safe. In an interview with George Washington Today, Mr. Steinour shared how the university community can identify phishing and report email scams if they occur.
Q: What exactly is phishing, and how can email users avoid it?
A: Phishing is a type of online scam that uses false e-mails, forms and websites to collect personal information for identity theft. Such information can include usernames, passwords, Social Security numbers, credit cards and other information. Many of these scams appear legitimate but should be avoided and reported to [email protected].
Never reply to an e-mail with your password, GWid or PIN. Always hover over links to verify them before clicking. If you have any questions about the validity of a link you see or a message you receive, please forward it to [email protected] or contact the IT Support Center at 202-994-GWIT (4948), [email protected] or http://itsupport.gwu.edu.
Q: What are some tips for identifying and recognizing phishing?
A: Phishing messages look like official correspondence and can be very difficult to detect. However, one thing that may indicate if a message is fraudulent is if it asks for personal or financial information. A phishing e-mail may ask you to visit a link that appears legitimate, but actually sends you to a malicious site or webform designed to steal your account or personal information.
Detecting phishing requires attention to detail, but responsible organizations will never ask for your passwords or other sensitive information via e-mail. If you receive a message asking for private details, be suspicious.
The Division of IT provides quick reference guides to demonstrate how to detect phishing attempts at http://go.gwu.edu/checklinks and http://go.gwu.edu/detectphishing. For examples of current phishing attacks affecting GW, please visit http://go.gwu.edu/phishes.
Q: What is the Division of IT doing to protect GW email users?
A: The Division of IT is constantly working to protect users from phishing and other attacks. We implement mail filters and block lists at GW and work with Google and peer institutions to ensure our users are protected as much as possible. More than 93 percent of e-mail messages sent to GW users are filtered as spam, malware or phishing. The Division of IT has deployed more than 60 custom mail filters since January 2013. Phishing is constantly evolving to bypass filters and trick users, and while the Division of IT works to block phishing attempts as much as possible, some attacks occasionally get through to GW inboxes.
Q: Has there been a rise in phishing recently?
A: Phishers have increased the number and sophistication of attacks against GW and other universities. Recently, several phishing attempts have targeted GW community members in order to gain access to the GWeb Information System and change their direct deposit information. The e-mails appear to come from a fake help address that sends the user to a phishing site that appears to be GWeb. As a result, the Division of IT has attempted to increase user awareness of the issue and is proactively contacting anyone that might be a victim.
Q: What should email users do if they have responded to a phishing attack or clicked on a malicious link?
A: Don’t panic. GW has a dedicated team of security experts to help you. If you replied to a phishing attack or clicked a phishing link, forward the e-mail or link to [email protected]. Describe any information you submitted and provide as much detail as possible. Include full headers if you know how. Next, contact the IT Support Center at 202-994-GWIT (4948), [email protected] or http://itsupport.gwu.edu. Technology assistance is available through the IT Support Center 24 hours a day. Finally, begin to change or protect any information that you may have provided. If you submitted your password, change it immediately on any system or website for which you use it. If you submitted financial information, contact your financial or banking institution immediately.
To report phishing, e-mail [email protected] or contact the IT Support Center at 202-994-GWIT(4948), [email protected] or http://itsupport.gwu.edu. Technology assistance is available through the IT Support Center 24 hours a day.