1. Division of Information Technology
  2. Security

Information Security

Phishing

The Phishing Scam Artist

What is phishing?

  • Phishing is a form of cyber-attack where the attacker ‘mimics’ another person, university or business with the hopes of tricking the user into clicking a link and/or providing their personal information.

What do they want?

  • Money! Or worse - your identity!
    • Oftentimes the attacker is looking for personal information – social security number, username and password, or banking information – in order to gain access to your account(s).
  • Control!
    • Other times the attacker is attempting to infect or take control of your device.

What’s in their ‘bag of phishing tricks?

Does phishing sound scary? It can be. The best defense is being informed and knowing how to avoid becoming a victim to a phishing email. Attackers have quite the array of ‘tricks’ they use to trap a user such as:

  • URGENCY! Telling you this needs immediate attention, or ELSE!
  • Suspicious links
  • Attachments
  • Using the same logo/format as an email you’d expect to see from an otherwise established institution to gain your trust

How to protect yourself

Be critical of the email and assess who it’s from and the reason behind it. Is the email asking for your credentials? Are they trying to get you to open an attachment? Click on a link? Sometimes it is smart to call the organization or check the organization’s website to verify if they are sending emails of this nature out to their users/customers.

  • Do NOT:
    • Keep any detailed personal or family information in your stored emails.
    • Maintain any personally identifying information such as driver’s license, SSN, passwords, credit card numbers or date of birth in your emails.
    • Write your passwords down, share or email your passwords to anyone or use commonly constructed passwords (pet names, family names, SSN, etc.).
    • Walk away from your computer while still logged into your email without locking your screen.
    • Use your date of birth or easily obtained information for passwords or password reset questions.
  • Do:
    • Safeguard your passwords and information.
    • Always lock your computer and/or device.
    • Report any suspicious emails to abuse@niu.edu.
    • Use common sense and a critical eye when reviewing emails.
    • Always log in with a trusted URL.
    • Verify the link sent in an email by 'hovering' over to see its true destination.
    • Verify the sender of the email by 'hovering' over their name to see what email address was used.

Oh NO! I just answered that phishing email; what do I do now?

If you responded to a request for a password and/or provided account information to someone inadvertently:

  • Change your password to a dissimilar and better password immediately.
  • Notify the IT Service Desk immediately at 815-753-8100.
  • If you believe your financial accounts may be compromised, contact your financial institution immediately and close any accounts that may have been compromised. Watch for suspicious charges to your account.
  • If you believe your identity may be compromised:

More Information

Active Phishing Scams

Report it!

If you receive a phishing e-mail, forward it as an attachment to abuse@niu.edu.

COVID-19 Scams

Due to the global COVID-19 pandemic, the number and manner of scams is increasing sharply. If you have any concern about a potential incident or worry you might have fallen victim to a phishing attempt, please contact our Information Security team by sending an email describing the incident to abuse@niu.edu and refer to email phishing. The current scams will be updated in our IT Service Portal under "Phishing/Security Events". You will need to login before you can review it.

Malicious Phone Calls

Bad actors are pretending to be:

  • IT support
  • From your Bank
  • From your Credit Card company
  • From your Insurance Company

None of those resources will make an unsolicited call to you.

They will ask for your account, or personal information, or ask you to verify a PIN, or ask you to go to a website for assistance.

Do not do it, and do not give any information to the caller.

Hang-up, and if necessary contact the appropriate resource through normal channels.

  • IT support – IT Service Portal or your local IT support
  • From your Bank – go to your bank’s website and see how to contact them
  • From your Credit Card company – use the phone number on the back of your credit card
  • From your Insurance Company – use the contact information on your insurance card

Email Phishing

Malicious emails about COVID-19 containing malware are also on the rise. These emails are spoofing health related organizations and claim to offer cures, vaccines, tests or other opportunities related to COVID-19. If you receive such emails, Please do not reply to the email or click any link or open any attachment, and just send the email itself as an attachment to abuse@niu.edu.

These emails will falsely claim to be:

  • CDC Alerts – The CDC will not send you an unsolicited alert. The only way to get alerts from the CDC is to go to their official website and subscribe.
  • Health Advice or Healthcare Organizations – These will ask you to click a link or open an attachment to get access to a test, vaccine, a cure or to download/review safety measures. Clicking the link or opening the attachment will either download malware or persuade you to enter personal information.
  • Local Public Safety or Public Health alerts – These will claim you need to click some link to stay safe or register to stay safe or need to open an attachment since you missed an important phone call from them.
  • NIU officials and NIU Departments – These emails will likely say there is an urgent change in policy and you need to click on a link or open an attachment.

Malicious Websites

An astonishing number of new websites using the COVID name have popped up. These are not reputable websites at best, and at worst deliver malware to your computer right through your browser.

examples of malicious websites

Malicious Mobile Apps

Please beware of all sorts of new COVID mobile apps.  A new Android app at a website called “coronavirusapp” is a ransomware locker.

Some other coronavirus apps have been identified as info stealers

Please only use reputable mobile apps.

What to do if you think you are a victim 

If you responded to a request for a password and/or provided account information to someone inadvertently:

  • Change your password to a dissimilar and better password immediately.
  • Notify the IT Service Desk immediately at servicedesk@niu.edu, and abuse@niu.edu
  • If you believe your financial accounts may be compromised, contact your financial institution immediately and close any accounts that may have been compromised. Watch for suspicious charges to your account.
  • If you believe your computer has been compromised by malware please do a windows defender offline scan and contact your IT support. Instructions for doing the scan can be found at the following link. 

 If you believe your identity may be compromised

  • Please visit the Federal Trade Commission’s Consumer Information regarding Identity Theft at ftc.gov/ID theft for more information and steps to recover; OR
  • Please contact your local police department; OR You may contact the NIU Department of Police and Public Safety at 815-753-1212 or NIUPD@niu.edu;
  • Contact credit bureaus to freeze your credit.

Security Services at NIU

  • Annual Data Breach Reports:
  • MFA for Applications:
    • it.niu.edu Request Services  MFA For Application
  • System Vulnerability Scan:
    • it.niu.edu Request Services  System Vulnerability Scan
  • Vendor Assessments:
    • it.niu.edu Request Services  Assess Vendor/App Security

Contact Us

Division of Information Technology
815-753-8100
ServiceDesk@niu.edu

Submit an Incident or Request a Service

Search Knowledge Base

Back to top