What is phishing?

Phishing is an identity-theft scam that uses "spoofed" or fake emails and websites to trick people into giving out personal information, such as credit card numbers, usernames and passwords, or social security numbers. Phishing is usually done by hijacking the brand identity of a bank or an online store in a spoofed email that is sent to large numbers of people. The email will usually contain a link to a web page designed to look just like a legitimate company's site. A phishing scam will use this page to capture any information that you provide, then sell or use the information for malicious purposes.

Several variations of fraudulent email messages claiming to be from UIOWA Support, UIOWA.EDU, Webmaster@uiowa, etc. have been reported over the last several months. Phishing emails claim you must either click on a link to log in to a website, or click on a link and provide personal information, such as your password, last four digits of your Social Security number, date of birth etc., or risk having your accounts deactivated. These are not legitimate messages.

Phishing can also come in the form of SMS text messages ("smishing"), where someone might send you a text message to your personal phone number or send an SMS text message to your email address. Usually these are targeted to specific employees that work with the person that they are trying to impersonate, that they can find from job posting websites and organizational charts. Smishing attempts often ask for someone to go out and purchase something for them such as gift cards or provide personal information. These are not legitimate, especially if the person has not contacted you outside of work or class before or the text messages are coming from a strange number.

ITS will never ask you to send passwords or any other personal information in an email. Be cautious of links in email messages that take you to websites that ask for your HawkID.

NEVER respond to spam or phishing emails if you receive them. Responding to the message only identifies your email address as a target for future phishing schemes.  The best course of action is to just delete the message.

If you receive a suspicious SMS message that might be SMS phishing, do not respond to the sender and if necessary, contact the individual through a separate, trusted contact method such as a university email or work phone number to verify the request.

If you receive a phishing message, please follow the instructions on how to report a phishing scam.