Spotting Spooky Phishing Spells and Phantom Emails

Posted by on

But first...Quick Bytes. Monday Minute by Quick Bytes!
October is National Cybersecurity Awareness Month, and a great time to give your digital workspace a quick check-up. With chilling articles about cybercrime in the news targeting both our personal data and work emails, it can make us feel a bit uneasy. Taking a few seconds to spot suspicious messages can make a big difference in keeping our data safe. 

The data behind the tricks

A multi-year study by the National Cybersecurity Alliance, Oh Behave! Cybersecurity Attitudes and Behaviors Report highlights why staying sharp in our inboxes matters:

  • Phishing is Threat #1: Phishing accounts for 40% of all reported cyber incidents. Fake emails and trick links remain the primary methods used to gain unauthorized access to accounts.

  • The MFA Usage Gap: While 77% of adults know what Multi-Factor Authentication (MFA) is, regular active use is only 53%. 

  • Cybercrime is normalized: Worry about cyber threats has climbed from 57% in 2022 to 68% in 2025. In fact, 31% of participants now feel that losing money or data online is practically "unavoidable" (up from 25% in 2022).

Staying secure doesn't have to be complicated. Just a few simple habits will keep these digital ghosts from stealing your data. 

Ways to unmask suspicious messages

Sense of urgency

The trick: Phishing emails create fake panic with subject lines like "Urgent: Your UMN account will be suspended in 24 hours," "Immediate action required regarding your ID", or a suspicious "urgent request" from leadership.
The fix: Take a beat! Official University notifications will rarely demand immediate action under threat of instant account deletion. When an email feels pushy, verify it through a known secondary channel, like the UMN helpdesk, before taking any action.  

Phantom senders & disguised links

The trick: The sender's display name might say "UMN Help Desk" or "Extension HR," but the underlying email address could be completely unrelated. 
The fix: Always inspect the sender's full email address, not just the display name. Before clicking any button or link, hover your mouse over it to preview the destination URL. If the email or URL points to a strange link or unfamiliar domain, leave it alone!

Fake login pages

The trick: Phishing links often lead to web pages that look identical to the standard University login screen, tricking you into entering your Internet ID and password.
The Fix: Always check your browser's web address bar before typing in your login credentials. The official University of Minnesota sign-in page URL always begins with login.umn.edu. If it shows anything else, close the tab immediately.

What to do when you spot a phishing email

Don't just delete it. Report it. 
  • Forward suspicious messages directly to UMN Security at phishing@umn.edu
  • Click the kebab (⋮) in the top right corner of the email and select Report phishing
  • Trust Your Duo Shield: If you ever receive an unexpected UMN Duo MFA push notification on your phone when you aren't actively trying to log in, tap Deny right away!

Additional resources:


Comments

Post a Comment