Identify and Report Phishing Emails

Description

This article provides instructions on how to identify phishing emails and report suspicious messages at Idaho State University (ISU).

Note: Phishing attempts can also appear as Google Calendar invitations containing suspicious links. 

Guide Navigation

How to Identify Phishing Attempts

Phishing emails are designed to trick you into sharing information, opening malicious files, or visiting unsafe websites. Before responding to an unexpected email, review the sender, message, and links carefully.

Check the Sender’s Email Address

Check the sender's full email address. Pay close attention to the part after the @ symbol.
  • Official ISU email addresses end in @isu.edu
  • Be cautious of addresses that use misspellings or misleading formats.
  • Example: bennybengal.isu.edu@gmail.com is not an ISU email address. 

Tip: An email address that looks familiar does not always mean the message is legitimate. Review the entire address before taking action. 

Review the Greeting

Pay attention to how the message addresses you. 
  • Be cautious of generic greeting such as:
    • Dear Student
    • Hello Customer

Tip: A generic greeting does not automatically mean an email is phishing, but it can be a warning sign when combined with other suspicious details. 

Check for Spelling and Grammar Issues

Read the message carefully and look for: 
  • Misspelled words
  • Unusual phrasing
  • Poor grammar
Examples of suspicious phrasing:
  • We detected something unusual to use an application.
  • A malicious user might trying to access.
  • Please to contact IT Service Desk.

Watch for Urgent or Threatening Language

Be cautious when an email pressures you to act immediately or threatens consequences if you do not respond. 
 
Examples include: 
  • Act Now
  • Hurry
  • Limited Time

Warning: Phishing messages often use urgency to encourage you to act before you have time to verify the message.

Be Careful with Links, Attachments, and Calendar Invites

Be cautious with unexpected links and attachments, even when the message appears to come from someone you know.
 
On a Computer:
  1. Move your cursor over the link without selecting it. 
  2. Review the web address that appears.
  3. Check the address matches the website you expect to visit.
On a Mobile Device:
  1. Press and hold the link without opening it.
  2. Review the web address in the link preview.
  3. Verify that the address matches the website you expect to visit. 

Warning: Do not open an unexpected attachment or select a suspicious link. If you are unsure about a message, report it as phishing. 

How to Report Phishing Emails

  1. Open Gmail
  2. Open the suspicious email.
  3. Select the More menu (three dots).
  4. Select Report phishing.

How to Report Phishing Calendar Invites

  1. Open the calendar event.
  2. Select the More menu (three dots).
  3. Select Report as spam.

Change Google Calendar Invitation Settings

You can limit which calendar invitations are automatically added to your calendar. 
  1. Open your Google Calendar.
  2. Select Settings.
  3. Select Event settings.
  4. Locate Add invitations to my calendar.
  5. Select Only if the sender is known.

Tip: This can help reduce unwanted calendar invitations from unknown senders. 

Print Article