How to spot and report the latest phishing attempts at UK
Today's phishing emails are so common; identifying them may seem straightforward.
Typically, incorrect grammar, job offers too good to be true or emails asking for personal identifiable information are all telltale signs of a phishing email.
But as cybercrimes become more complex, phishing attempts aren’t always obvious.
University of Kentucky Information Technology Services (UK ITS) wants students, faculty and staff to know how to identify and report the latest phishing attempts.
Phishing attempts via Teams
Phishing attempts aren’t limited to emails. They may also come in the form of texts and chats from messaging apps.
UK ITS has seen an increase in phishing attempts through Microsoft Teams messages.
These specific phishing attempts impersonate IT support and are sent by external Microsoft email addresses.
Please note that UK ITS will never contact students, faculty or staff by using an external email address through Teams.
Before accepting unsolicited Teams messages, first walk through the following steps:
- Verify the user’s email address. University email addresses end in uky.edu.
- If the message is expected, be sure to double-check the email address.
- Do not click on any links.
- Do not provide any personal information.
- Report the message within Teams.
- Report the message to the UK ITS cybersecurity team.
How to report a phishing email or message
UK ITS routinely sends out phishing simulation messages to ensure the university community is reporting suspicious emails.
It is better to report a message or email that appears to be suspicious instead of not reporting it. If you report a suspicious email or message that turns out to be legitimate, it does not do any harm.
Microsoft Teams
- Hover over the message until you see three dots.
- Click on the three dots and select the “Report this Message” option.
- You can also right click on a message bubble and select the “Report this Message” option.
Microsoft Outlook
- Hover over the three dots in the top right corner of the email.
- Click on the first option “Report as junk, phishing or not ju...”
- If using a Mac, click the “Report Message” button at the top of the message or right click the email and select “Report Message.”
- A new window appears with the options to “Report Message” as “Junk,” “Phishing” or “Not Junk.” Select the option that you think best describes your message.
- For step-by-step instructions with screenshots, refer to How do I report spam and phishing emails: https://uky.service-now.com/techhelp?id=kb_article&sysparm_article=KB0012712&sys_kb_id=282b131b975f0a1414b23fa6f053afe9
How to spot a phishing message or email
Phishing attempts create a sense of urgency and often attempt to impersonate government agencies or well-known institutions like the University of Kentucky.
Never click on unsolicited links, provide any type of personal identifiable or financial information, fill out any forms like Google forms or reply to any emails or messages you were not expecting.
The following types of messages are phishing attempts and should be reported:
- A Teams message from an external email address or account claiming UK ITS or IT support needs to contact you.
- An email claiming your account is suspended and asking you to verify your identity via a link or by filling out a Google form.
- An email warning about suspicious bank account activity that requests your PIN.
- An email containing an unrealistic job offer.
- An email from an unknown sender that creates a sense of urgency, contains misspellings or bad grammar.
- Text messages from government agencies requesting payments for fines or tolls via texts.
- Texts containing a sense of urgency that claim penalties are owed for unpaid fines.
- An unknown number or URL asking the user to click on the link or copy and paste it into a browser.