There has been an increase in emailed scam attempts received by members of the university community. The type received most often has been a gift card scam. Such scams appear to come from a department chair or other high-ranking employee asking the recipient to purchase multiple gift cards.
However, these CWRU members are being impersonated by scammers—a practice known as email spoofing. Email spoofing is a kind of phishing, a category of cyber-crime marked by an attempt to trick individuals into divulging their network credentials, credit card numbers or other personal information.
The Information Security Office (ISO) wants to take this opportunity to relay some common ways to identify potential phishing attempts. If an email seems suspicious or too good to be true, please follow the steps below to identify a possible phishing attempt before responding to it:
- Check the sender field to make sure it matches the name that is expected.
- For example, if the name in the “From:” field is supposed to be someone from CWRU, the listed email address that follows it should be from the case.edu domain—unlike the sample below, in which it is from a standard Gmail account:
- For example, if the name in the “From:” field is supposed to be someone from CWRU, the listed email address that follows it should be from the case.edu domain—unlike the sample below, in which it is from a standard Gmail account:
- In this particular case, be aware that no one from CWRU will ask other community members to buy gift cards for them, especially not out of their own pocket. In general, be skeptical and cautious about any claims, offers or requests.
- Look for signs of urgency or requests for action that are described as time-sensitive.
- Hover over links to check that they are actually going to the anticipated site. If in doubt, do not click any questionable link.
- Check for grammar errors or unusual phrasing (e.g., use of the word “kindly”).
- Call the person who is making the request to confirm it is actually coming from them.
These best practices will help CWRU email account holders to better identify phishing attempts.
- If you receive a phishing email, please forward it to security@case.edu and report it as phishing to Gmail (in the email, click the ‘More’ button at the far right next to the ‘Reply’ arrow, then click ‘Report phishing’ in the resulting drop-down).
- If unable or unsure to determine whether an email is legitimate, please send it to security@case.edufor verification.