It could happen to you.

In March, NC State experienced an unusually high number of phishing attacks, resulting in 136 compromised email accounts that belonged to undergraduate and graduate students, faculty and staff, and former students. Phishing attacks are typically associated with email and are attempts to steal your personal information such as account names, passwords and banking and credit card information.

Many of these phishing emails were purported to come from the NC State Help Desk and included information about an upgrade to the NCSU Gmail account. If you look closely, these phishing attacks (like the example below) were actually sent from the email accounts of campus users who had previously fallen victim to a similar phishing email.

——– EXAMPLE ——–

From: Tom Who <who@ncsu.edu>

Date: Mon, Mar 21, 2016 at 9:47 AM

Subject: NCSU Administrator

To:

Today Monday 21st March, 2016, we are shutting down your present Gmail Account to create space for 2016 New NCSU Google mail with a high visual definition and Space. This service creates more space and easy access to email. Please update your account by clicking on the link below and fill information for activation.

CLICK HERE

Follow the procedure and complete information by clicking SUBMIT. A new space will be created within 48 hours.

Thank you for understanding.
North Carolina State University

——– END EXAMPLE ——–

The example above and similar emails are ALL fake and are attempts to steal your login credentials. You already have unlimited storage with your Google Apps @ NC State Account, and there are no options for high-definition visualization space or Gmail/Outlook upgrades.

If you respond to a phishing attack, it can cause problems for you and the entire NC State community. Your account becomes compromised, and suddenly it is sending out hundreds of phishing messages to others within the university domain and beyond. The university’s “Internet reputation” decreases if its ncsu.edu domain is viewed as a spammer.

Don’t become a statistic. Stay aware and remember these tips:

• NEVER open any email or attachment from someone you don’t know. If you’re not expecting it, don’t open it unless you verify it with the sender.
• ALWAYS hover over a link to verify its intended location. Never click on suspicious or unrecognized links in emails, including those from NC State.
• Forward any suspicious email with an ncsu.edu address to phishing@ncsu.edu or call the NC State Help Desk at 515-HELP (4357). Once you’ve clicked on a phishing email, it’s possible you’ve already started a chain of bad events.
• Activate Google’s 2-Step Verification to add an additional level of security beyond password protection for your accounts and documents.
• Check SysNews for postings on large-scale phishing attacks as well as information on outages or upgrades thatmay require some action on your part.
• Remember that NC State personnel will NEVER ask you to reveal personal information such as passwords or other restricted data by email, phone, text, or other means of communication.

If you or individuals within your department are interested in learning more about 2-Step Verification or phishing in general, check out Classmate to view OIT’s training courses to keep you aware, safe and informed.