Security: Phishing and Spam
Phishing
Phishing scams are fraudulent messages appearing to come from legitimate sources, for example, your university, your Internet service provider, or your bank. These messages usually direct you to a spoofed website or tell you to reply to get you to divulge private information (e.g., password, credit card, or other account updates). The perpetrators then use this private information to commit identity theft or use your email account to send spam or other fraudulent messages.
Phishing scams are designed to induce panic in the reader. These scams attempt to trick recipients into responding or clicking immediately, by claiming they will lose something (e.g., email or bank account access). Such a claim almost always is indicative of a phishing scam, as responsible companies and organizations do not usually take these types of actions via email. A phishing scam, for example, is a message warning there is fraudulent activity on your account, and asks you to "click here" to verify your information.
To report a phishing email, expand the full header of the message and forward it to abuse@uark.edu. To learn how to expand full headers, go to the Report Abusive Email with Expanded Full Headers Tech Article.
Avoid Phishing Attacks
-
Be suspicious of any email asking you to enter or verify personal information through a website or by replying to the message itself. Never reply to or click the links in such a message. If you feel the message may be legitimate, go directly to the company's website by typing the URL in your browser, or contact the company to see if you really do need to take the action described in the message.
-
When you recognize a phishing message, delete the email message from your Inbox, and then empty it from the deleted items folder to avoid accidentally accessing any links contained in the message.
-
When you allow your mail client to read HTML or other non-text-only formatting, attackers can take advantage of your mail client's ability to execute code, which leaves your computer more vulnerable to viruses, worms, and Trojans.
Spam
Spam is unsolicited bulk email—indiscriminate, network-wide broadcasted messages which distribute advertisements and solicitations. Chain letters, items for sale, get rich quick schemes, or any other unwanted email that people often receive are examples of spam.
However, email offers from sites at which you have an account are not considered spam.
If you receive a spam message, it's best to ignore and delete it. Never reply to these messages, and never send money or personal information. Many email applications have filtering capabilities that block messages from specified addresses, but spammers often vary their addresses and hide their real identity.
Since spamming is against the Code of Computing Practices, you are responsible to avoid sending spam yourself. Do not send emails to large groups of people unless you know each of them personally, and make sure your message is appropriate for all of the recipients. Users who are found to have initiated or propagated chain email messages or spam messages from a university account (even with good intentions) will be locked from that account for two business days. Subsequent violations of this policy will result in additional administrative sanctions.
For information on filtering spam messages, see the Email: Spam Filtering Tech Article.
To report spam to IT Services, forward it to abuse@uark.edu with expanded headers. To learn how to expand full headers, go to the Report Abusive Email with Expanded Full Headers Tech Article.
Spoofing
When spammers use someone else's email address to send email to potential victims, it is called spoofing. Sometimes they will use the From: addresses of major service providers such as PayPal, eBay, Microsoft, or a university when mass mailing. You could receive a message that appears to be important information from an important source.
Spammers might also use one of the email addresses from a list of harvested addresses. Email that cannot be delivered will be bounced to the address in the From: field. If your address was harvested and used as the From: address, you could receive returned messages that you did not send.
For information on filtering spam messages by subject line, see the Email: Spam Filtering Tech Article.
Chain Email
A message sent to several people requesting that each recipient send out multiple copies of the email to increase its circulation exponentially is a chain letter. Chain letters share a similar pattern:
-
The hook—something to catch your interest such as "Make Money Fast," "Virus Alert," or "People are dying"
-
A threat—something bad will happen to you if you break the chain
-
A warning—you are responsible for letting all your friends know about a (usually fake) computer virus that's going around
-
A guilt trip—something to play on your sympathy, such as telling you that a sick child has requested that the chain letter be sent on
-
The request—usually last, asking the recipient to send the message on to several others
Since chain letters are sent to ever increasing numbers of users, a chain email has the potential to waste great amounts of bandwidth and disk space and clog up networks. The use of university computing resources to send chain email or spam mail is a violation of the Code of Computing Practices and user accounts initiating chain email messages or spam messages may lose access for two business days. Chain mail that contains requests for money or items of value is also illegal (in violation of Title 18, U.S. Code, Section 1302, the Postal Lottery Statute).
If you receive a chain email, either delete the email without sending it to anyone or report it to IT Services. To report the email, forward it to abuse@uark.edu with expanded headers. To learn how to expand full headers, go to the Report Abusive Email with Expanded Full Headers Tech Article.
Be Safe on Facebook
As with threats via email, it is important to remain vigilant about phishing attacks and spam in a social media context such as Facebook. Only click links from reputable sources, and never download an app or take a quiz if you have any reason to suspect it was not sent by the friend or friends who recommend it. The repetitive appearance of suspicious wall posts, especially by a number of friends, could be evidence of malicious activity.
Take advantage of the tools below provided by the Facebook security team to protect your account and your personal information from malicious users and software.
-
Go to facebook.com/security and click on Threats for important information on detecting and avoiding spam, chain letters, phony messages from Facebook employees, clickjacking, malicious groups and pages, suspicious applications, and money transfer scams. Like this page to recieve important updates and reminders about Facebook security.
-
Go to facebook.com/safety/tools for general information about protecting your account, controlling who sees your personal information, and advanced security features.
-
Go to facebook.com/safety/tools/apps for tips on how to use apps safety.
Last Reviewed: