Spot Fraudulent Emails (Phishing)
This article applies to: Security & Policy
Confirm the source
- Some fraudulent emails (phishes) targeting Cornell are listed at IT@Cornell’s Phish Bowl.
- Some trusted emails from departments are listed at the Verified Cornell Communications page.
- If the request appears to be from a Cornell department, contact the department with information you find when you look up its number at Search Cornell.
- If the email isn’t listed on the Verified Cornell Communications page, and you don’t get a timely response from the department, contact the IT Service Desk for help.
- If it appears to be from a service outside Cornell, such as your bank, PayPal, eBay, or a credit card service, look up their contact information using a trusted source (the 800 number on the back of your credit card or by searching for the service’s official website at a trusted search engine).
Report suspected phishes to the IT Security Office. Be sure to include the entire text of the message and email headers. Use the Phish Bowl to see some phishing (fake) emails that have been spotted at Cornell.
Video: Email Phishing 101
As criminals gain access to more information about people, Internet fraud attempts become more sophisticated and narrowly targeted.
Messages claiming to be from a Cornell office or official, requesting personal information and passwords.
Invitations to see photos of family or friends, greeting cards, or pleas for disaster relief assistance.
- Bogus URLs may link to imitations of legitimate, popular web sites, such as eBay, Amazon, or personal banking sites. Cornell’s CUWebLogin page has even been mimicked.
Obvious clues that MAY indicate an email is a scam
It's poorly written. It may be written with ALL CAPS, have spelling and grammar errors, or it may seem fragmented.
It asks you to send personal information (Social Security, credit card, bank account, passwords, date of birth, address, phone numbers, etc.).
It tries to scare you into reacting by creating a sense of urgency with exclamation points, words like “immediately,” or threatening to close an account.
It offers something that's too good to be true.
It has a From address that doesn’t make sense or doesn't match the domain where it really came from.
- It requests money for disaster relief or another cause.
Hover over URLs before you click
Don’t assume that what you see is where you’ll go when you click.
In many browsers and email programs, hovering over a link (without clicking) lets you see the ACTUAL URL for the link. If the underlying link is different, be very cautious. As an example, hover over the link below and look for the real link to display in your browser (often in the bottom left corner):
Also be cautious of any link that doesn’t clearly indicate where it leads, like links that say (hover over these to see what's hidden beneath):
Watch out for forged email addresses
Email links are easy to check. See how to read web addresses (URLs in email and online).
From addresses in emails are more complicated to check, but they are very EASY to fake. Anybody can make their From address look like it came from someone you trust, like firstname.lastname@example.org, so if you don't feel confident after checking email links, see how to check email headers.