Sophisticated phishing scam targets OU students

The phishing e-mail being reported by OU students directs to the spoofed Web page above.

The e-mail begins, “Currently we are conducting a survey of current and former students as well as OU alumni which covers a variety of important topics and will allow the university administration and staff to make educated and relevant decisions concerning our students.” It offers a chance to win an iPod Touch and $50 gas cards as prizes for completing the survey, and it is signed “Office of Student Affairs, Oakland University.” If you receive this e-mail, you are advised to delete it immediately.

“These advanced phishing techniques prey on people’s familiarity and comfort level with institutions like Oakland University,” said Terrie Rowe, chief information officer. “Unfortunately, online scams are becoming more and more advanced, and people must begin to apply a higher level of scrutiny to each e-mail they receive.”

Essentially, phishing e-mails spoof contact from trusted organizations, attempting to steal personal information. More sophisticated phishing scams, like the one circulating at OU, also spoof a Web page from that organization.

“In this case, the e-mail says it is from the Office of Student Affairs, but the e-mail address it was sent from does not end with oakland.edu. This should be the first thing you check when you receive an e-mail,” said Rowe. “In addition, the URL presented within the message does not contain the oakland.edu domain, and there are egregious typos throughout the e-mail and the survey Web page. These are the kinds of clues you need to look for when you sort through your e-mail.”

To avoid being the victim of phishing scams:

• Never respond to e-mails that request personal information like passwords or account details. Trustworthy companies will never ask you for your password or account details via e-mail.
• Connect to Web sites by typing the URL into your browser’s address bar. Do not click on links in suspicious e-mails, because they may be designed to take you to a spoofed URL.
• If you are unsure about the legitimacy of a specific e-mail, visit the company’s home page or contact them directly.
• Report phishing e-mails that spoof legitimate organizations to those organizations. This allows them to address the scam with their community and avoid further trouble for their members.