Types of Phishing

Phishing

Phishing schemes are correspondence designed to steal from you. They often look official, with familiar logos or messaging, and will try to trick you into giving up information that can be later used in scams. You can usually identify a phishing attempt because they convey urgency, make claims or threats about the security of your account, ask for confidential information, or just seem suspicious. Phishing isn't just through email, it's also arriving through:

• Phone calls (spoofed calls, voice phishing or vishing), and/or
• Text messages (SMS phishing or smishing)

The National Cybersecurity Alliance makes it easy with a full library of topic-specific cybersecurity resources you can download - but in general, look for these signs:

• Asks you to reply with personal information, such as your ID or password, or to click a link to submit personal information.
• Email address doesn’t match the sender: for example, official Sac State communications will only come from @csus.edu email addresses.
• Generic email salutation instead of your name, or an incorrect recipient, or "Dear User."
• The “From” field has a .com, .org, or .net address, not a name ("Bob Smith") or specific group (“Office of the President”).
• Contains typos and grammatical errors

Common attacks via campus email includes financial aid scams, “fake job” offers, tax season attacks, and scammers taking advantage of those working remotely during COVID-19.

Spoofing

Spoofing is when a scammer deliberately falsifies the information transmitted to your caller ID display to disguise their identity. Scammers often use spoofing numbers so it appears that an incoming call is coming from a local number, or spoof a number from a company or a government agency that you may already know and trust. If you answer, they use scam scripts to try to steal your money or valuable personal information, which can be used in fraudulent activity.

Spearfishing

Unlike phishing, which is a broad net cast to large groups of people, spearphishing is a targeted attempt to steal your sensitive information through messages that appear to come from someone you may know. Spear-phishing attackers find their victims by scanning social networking sites and gathering an individual's email address, friends list, geographic location, and any posts about new gadgets that were recently purchased. The attacker then uses this information to act as a friend or a familiar entity and send a convincing but fraudulent message to their target asking them to open a malicious attachment or click on a link that takes them to a spoofed website to provide passwords, account numbers, PINs, and/or access codes. Spearfishing is the most successful form of acquiring confidential information on the internet, accounting for 91% of attacks.

Advance-Fee Scam

An advance-fee scam is a form of fraud and is one of the most common types of confidence tricks. The Federal Bureau of Investigation (FBI) defines an advance-fee scam as "when a victim pays money to someone in anticipation of receiving something of greater value - such as a loan, contract, investment, or gift - and then receives little or nothing in return."

The scam typically involves promises a victim a significant share of a large sum of money, in return for a small up-front payment, which the scammer claims will be used to obtain the large sum. When a victim makes the payment, the scammer either invents a series of further fees for the victim to pay or simply disappears.

Current Scams

Fresh Phish: Beware of These Phishing Scams

The most common scams impacting students include "fake jobs" that sound too good to be true, or involve financial aid theft. These spearfishing scams occur especially during financial aid disbursement timeframes, and specifically try to trick students into providing their federal student aid login credentials.

Providing personally identifiable information (PII) through a "job application" or spearfishing attack can lead to further unwanted activity, account compromise, and financial aid theft. The University and legitimate businesses will never ask for this type of information in emails.

Current Phishing Scams

Additionally, here’s a list of current (and some ongoing) phishing attacks against campus accounts. We’ll keep this list updated, so check back whenever you wonder whether a new, widespread scam may be occurring.

1. Office 365 "Account Termination"
2. Fake Job and Computer Purchase
3. "Duo flooding" - Duo push notifications you didn't originate
4. Spoofed "Sacramento State Phone Call" Scam
5. Fake Job Opportunity
6. COVID-19 Stimulus Payment Scams

Report Suspected Phishing

Received something phishy? Now comes the important part — reporting it so we can do some detective work to protect you and our entire campus community from further damage. First thing's first: do not click any links or open any attachments (they may contain viruses or malware), and report the message immediately in either of these ways:

Easiest/Quickest! Click the PhishMe Reporter button built into your Outlook menu. This automatically generates a report to the IRT Information Security Team.

Device-specific how to's for using PhishMe Reporter

— or —

Email the suspicious message as an attachment to abuse@csus.edu.

• Open a new email message
• Drag and drop the suspicious message into the body of the new message
• Add a subject line and click send
• Delete the message