What are phishing
scams and how can I avoid them?
Phishing scams are typically fraudulent email
messages appearing to come from legitimate enterprises (e.g., your
Internet service provider, your bank, eBay, etc.). These messages
urge you either to reply with your user name and password or to click
on a hyperlink that takes you to a bogus website where you are asked to
information (e.g., password, credit card, or other account
updates). The perpetrators then use this private information to commit
Symantec has a great video on the subject that
gets the user the basics in a pretty entertaining manner- see Internet
For examples of typical phishing tactics, see:
To really get your awareness up, see the Field Guide to
Phishing, then take the Phishing IQ
test at http://www.sonicwall.com/phishing/
How to avoid them
To avoid phishing scams, never click the links
types of email messages. If you feel the message may be legitimate, go
directly to the company's web site (i.e., type the real URL
into your browser) or contact the company to see if you
really do need to take the action described in the email
message from your Inbox, and then empty it
from the deleted items folder to avoid accidentally accessing the web
sites it points to.
You should also always read your email as plain
messages often contain clickable images that look legitimate; by
reading messages in plain text, you can see the URLs that any images
point to. Additionally, when you allow your mail client to
read HTML or other non-text-only formatting, attackers can
take advantage of your mail client's ability to execute code, which
leaves your computer vulnerable to viruses,
information, Indiana University has a great document In Windows, how do I force my
email client to display mail as text-only?
Reading email as plain text is a general best
avoiding some phishing attempts, won't avoid them all. Some legitimate
sites employ redirect scripts that don't check the
redirects. Consequently, phishing perpetrators can use these scripts
to redirect from legitimate sites to their fake sites.
Another tactic is to use a homograph attack,
International Domain Name (IDN) support in modern browsers, allows
attackers to use different language character sets to produce URLs
that look remarkably like the authentic ones. For more information,
Make it stop!
phishing email, you can report these phishing
scam attempts to the company that's
You can report spoofed login or personal-data-capturing websites to
Google will then label it a phishing site and flash a warning banner (click for an example) to
The Case Help Desk (216) 368-4357 can help if
• have received an email you suspect is a scam
• have responded to a scam email with your Case
• need help changing your password.
More information is available at
When in doubt, call a Trusted Human!