Hello UMBC Community!

The Cybersecurity Assurance and Digital Trust Department in the Division of Information Technology has some tips for you to stay safe from financial scams that have recently taken place.

Attackers send phishing emails to trick unsuspecting victims into providing their user ID, password, and multifactor codes. Often, these phishing lures contain a link that redirects the user to a login page.

DoIT has observed cases where the attackers are mirroring legitimate login screens to capture credentials and multifactor authentication (MFA) codes in real time. The only indicator that something is amiss is the URL in the address bar.

Follow these general tips to safeguard your financial data and funds:

1. Use Strong & Unique Passwords: Never reuse your UMBC password on other platforms — including financial services such as BankMobile. Create unique passwords for each separate account.
2. Periodically Verify Your Personal Information: Log into your accounts and make sure all your information, such as linked financial accounts, billing address, phone number, and email addresses are correct.
3. Check the Link: Look over URLs and ensure you are accessing a trusted service. If you see a login page but the URL does not look legitimate, do not provide your password or MFA codes. It is best practice to bookmark trusted services to navigate to them directly.
4. Don't Give Away Your Secrets: UMBC and your financial institutions will never call, email, or text you to ask for your password or MFA codes.

If you give someone your password and MFA codes, you are handing them the keys to your account. This could result in financial loss or unauthorized activity for which you may be held responsible.

If you see something, say something! Report all phishing emails to security@umbc.edu.

Stay smart, stay safe!

Hello UMBC Community,

We rely on Duo two-factor authentication to protect our accounts, and it's an excellent defense. However, cybercriminals are always looking for new ways to get past our security. This week's topic is all about what to do if you receive a Duo push notification you didn't initiate.

You're working on your computer, not logging into anything new, and suddenly your phone buzzes with Duo push notifications, including SMS texts or phone calls from Duo. What's happening? This is likely an attacker who has obtained your password and is attempting to bypass Duo to access your account.

Your immediate action is critical.

• Do NOT Approve It: The most important thing is to never approve a Duo push notification you did not initiate. Approving it will give the attacker access to your account.

• Deny the Request: Decline the request on your phone.

• Report as Fraudulent: If you can, mark the notification as fraudulent.

• Change Your Password: Immediately change your password on a trusted device or computer. This will invalidate the password the attacker is using.

Remember, a Duo push notification is like a digital handshake. You must be the one to initiate it. If someone else is trying to shake your hand, don't approve the connection!

If you received a Duo push notification you did not initiate, deny the request, change your password, and immediately report the event to the security team at security@umbc.edu. Your report helps protect everyone!

Stay safe out there.

Hello UMBC Community,

In the digital world, Phishing is one of the most used forms of cyber trickery where attackers impersonate trusted sources to deceive you into handing over credentials or personal information. These attacks come in various forms. Learning about them will help you not fall victim to those emails.

Phishing attacks are emails that may look like important messages but are actually crafted by cyber criminals. The good news? With the right knowledge, you can foil their tricks and keep yourself and UMBC safe. These are some tips on how you can recognize phishing emails:

1. Requests for Your Password: UMBC will never ask for your password. Never submit your password on Google forms or Monday.com forms. Your password is for your eyes only!

2. Unexpected Calendar Invitations: Watch out for calendar invites from unknown senders. Delete them and never click suspicious links inside.

3. Fraudulent Offers: Be wary of unsolicited offers for gift cards or jobs that are too promising. Do not send your personal or financial information to anyone who requests it over email or text. Real job postings are on Handshake only!

4. Unexpected Attachments or Links: Did someone send you a weird file or link you weren't expecting? Is a link in an email suspiciously short or strange-looking? If it feels off, don't click or download it.

5. A Sense of Urgency: Phishing emails often try to rush you into action, like claiming your account will be "deactivated" if you don't click a link immediately. Always be suspicious of urgent, high-pressure requests.

6. Poor Grammar and Spelling: While not always a giveaway, many phishing emails contain noticeable spelling errors or awkward phrasing.

What to do if you get a suspicious email:

If you suspect an email is a phishing attempt, do not reply, click any links, or open any attachments. Instead, forward the email immediately to the security team at security@umbc.edu. Your report helps protect everyone!

Stay vigilant, and together we can keep our digital environment safe.

Catch a "Fish"!