Rather than attempting to breach secure university firewalls or exploit software bugs, cybercriminals often manipulate human trust to trick individuals into willingly handing over access to their:
- Network ID,
- Passphrases,
- Multi-factor authentication (MFA) codes, or
- Financial details.
These attacks often rely on impersonating executives, faculty members, peers, trusted vendors or service providers across email, text messages and phone calls.
In the last month, the Office of Information Security at Case Western Reserve University has detected and prevented over 42,000 credential phishing and social engineering attacks across emails—an increase of 16,000 attacks compared to the previous month.
In recognition of Cybersecurity Awareness Month, the Office of Information Security encourages members of the CWRU community to watch for urgent requests, unfamiliar senders, misleading links, requests for MFA codes or gift cards, and unexpected attachments or messages.
Recognize red flags in emails and texts
Scammers use a predictable set of tactics to bypass default skepticism. Whether checking an inbox or reading a text message on a personal device, key indicators to watch for include:
- Artificial urgency: Messages demanding immediate action such as “Your account will be suspended in two hours,” “Urgent task needed while I'm in a meeting,” or an unexpected package delivery warning, are designed to trigger panic so you act before thinking.
- External email tags and sender mismatches: Pay close attention to external email banners and always inspect the actual sender email address, not just the display name. An official message claiming to come from university leadership or Microsoft Support sent from a generic @gmail.com address is more than likely a scam.
- Misleading links: Hover your cursor over links before clicking to preview the destination. If the displayed text says login.microsoftonline.com or case.edu, but the link points to an unrelated external address or strange URL, do not click it. Report and delete the message immediately.
- Suspicious texts and requests: Be extremely cautious of text messages (smishing) asking you to buy gift cards, click verification links or share MFA login codes. The same caution applies to unexpected phone calls or email attachments, requests to download unapproved software, or physical security risks like plugging in unknown USB drives.
How to take action
Case Western Reserve University [U]Tech will never send an email or text asking for your passphrase, login information or confidential personal information. If an email requests your login credentials via an attached link, and the site does not end in “case.edu” it is fake and should be reported immediately.
If an email feels suspicious or too good to be true, trust your instincts:
- Report it: Select the yellow Abnormal Report Phish button in your email client's sidebar or mobile app.
- Forward it: If you cannot find the report button, forward the email to phishing@case.edu for an automated security review.
- Get help: When in doubt, contact the [U]Tech Service Desk at help@case.edu or 216.368.HELP (4357).
- Ask security questions: Any additional questions or concerns can be directed to askinfosec@case.edu, where an OIS team member can help answer any cybersecurity related questions.
Taking three seconds to inspect an email header protects your private data and safeguards not only yourself, but the whole university community.
