osu 2nd annual phishing derby has ended but you can still help us catch phish

Even though our Phishing Derby is over, we still want you to catch phish!

When you send us phishing attempts that came to your oregonstate.edu email, you help us shut down the scammers who sent them. So, when a phishing attempt lands in your inbox, forward it to us (directions at https://uit.oregonstate.edu/ois/osu-phishing-derby/submit-your-phish).

Not quite sure how to spot a phishing attempt or how to distinguish it from spam email? Keep reading for more information.

fish symbolSo what is phishing?

It's an attempt to get you to give up sensitive information.

A phishing email looks like it comes from a trustworthy organization. It tries to get you to submit information like your username, password and credit card details.

It used to be easy to spot a phishing email. You could pretty much count on bad grammar, poor spelling and too-good-to-be-true offers.

Not so, anymore.

These days, lots of phishing attempts have gotten more sophisticated. Sure, you’ll still see some that fall into that old, easy to spot style. But more and more of them look professional. Because more and more phishing scammers are getting professional, spending real money to fool you, just as a professional fisher spends money on good bait.  [Read more about phishing at Wikipedia.org]

email on a fish hookCheck the Bait.

In this case, the bait is any email you receive. A simple phish will try to create anxiety, typically saying something like there is a problem with your account and asking you to reply to the email and provide your username and password so they can resolve the problem. Those are easy to spot. Trickier phishes include a link (often disguised) that will take you to a webpage where you will be asked to complete a form. The trickiest ones are crafted to look just like an official notification from OSU. They use our logo, often capture language used in previous official emails, and are "signed" by real departments or people.

You may also see phishes that pretend to be from a bank or other online business.

Remember, if an email makes you feel that you need to take action immediately, be suspicious. Also know that IT support people will never ask you for your password; instead, they'll change your password to a temporary one that you both know to fix any account issues that require it. These instances are rare and will never be resolved over email.

If an email makes you suspicious, but you're not sure it's phishing, call the sender and ask if it's legitimate. Be sure to use a number you already have or one you can look up, not the one provided in the email.

Recent Developments: Did you know that phishing isn't limited to just email? You may receive a phone call using the same anxiety creating techniques. Don't give any personal information, such as social security number, credit card or bank account numbers, health insurance information, or passwords over the phone.

Examples of strong wording include:

  • NOW!

Here are examples of phishing emails that we have received.

cursor hand hovers over a linkHover over the spot

In this case, the spot is a link in the email. When you place your cursor over that link and hover without clicking, the actual link will be shown, usually at the bottom of the window. In a phish you'll find that this link really goes to a different site than is shown in the link text. Check that link carefully -- the bad guys will frequently include portions of the authentic address to try to fool those who know the hover trick. Make sure that you inspect the entire address: if the portion before the first / in the address (after the http://) doesn't end in oregonstate.edu, don't click!

You can also hover using a mobile device. Simply touch the link and hold it. A window will pop up asking what you will want to do -- at the top of that window will be the actual link.

Be especially wary of URL shortening services such as tinyurl.com and bitly.com, since hovering doesn't work on them.

Try it out! Hover over the spot.

email symbolHow's this different from Spam?

Spam email, another type of unsolicited email, is typically advertising. The sender of a spam message wants to get you to visit a website where they'll receive a small compensation for every visit. Their goal is to get as many people to visit as possible, so they flood a network with thousands of email messages, hoping a few people will click on it.

You've seen lots of them: advertisements for pharmaceutical products, bargain hotels, special deals on travel -- if you can think of it, someone has sent a spam email about it.

Spam isn't just annoying though; often the websites linked in a spam email contain malicious software like viruses and adware. It is best to avoid them altogether.

Now that you know how to detect phishing emails, and how to distinguish it from spam email, are you ready to test your skills and "Catch a Phish?"

Winners of the Phishing Derby - Congratulations!

Congratulations to the winners of our Phishing Derby!

Everyone who entered helped make OSU a safer place. We collected 1,425 entries - that's 1,425 phishing attempts that got caught by our Derby participants. You rock! From those entries, we randomly selected 8 winners.

Winners of the $50 gift certificate to the Beaver Store

Harrod, H.
Johnston, K.
Larson, M.
Michels, A.
Rieth, M.
Schlonga, C.
Sumida, G.
Valenzuela, L.