Staff Tools and Services

Phishing Attacks 

Phishing is a psychological attack used by cyber criminals to trick you into giving up information or taking an action. Phishing originally described email attacks that would steal your online username and password. However, the term has evolved and now refers to almost any message-based attack. These attacks begin with a cyber criminal sending a message pretending to be from someone of something you know, such as a friend, your bank, your company or a well-known store.

How to Recognize a Phishing Attack

• A URL inconsistent with the message (for example, a message that claims it is from the service desk but does not include ucdenver.edu or cuanschutz.edu in the URL)
• Spelling errors, poor grammar and odd formatting
• A reply-to email address that is not from "ucdenver.edu" or "cuanschutz.edu"
• A request for a password or other sensitive data
• Generic greetings, like "Dear customer"
• Threat to delete account if no action is taken

Remember that legitimate companies and organizations will never ask for passwords, social security numbers, and other sensitive data via email.

How to Know if Your Account is Compromised

• You are unable to login to your account because hacker changed the password or it’s clearly disabled or locked
• You are unable to send email to external addresses because Microsoft blocked it
• You notice missing emails or returned undelivered emails
• You find an unknown forwarding email or deleting email rule in place
• You see multiple unknown sent items appear in the “Sent Items” folder

The university community can report suspected phishing or junk emails by clicking Report Phishing or Report Junk in the email message using Microsoft Outlook. Visit the Information Security and IT Compliance website for additional information about reporting phishing.