Was this helpful?

Suggest Improvements

Not this spam…

A picture of the Brand Spam of processed canned pork and ham with a speech bubble: It wasn't me!

Quick Access to Each Section:

Check, ignore and report
Common phishing or scam activities
Did you know?

Check, ignore and report

The primary and the ultimate goal of any of the activities is to steal sensitive information such as usernames, passwords, credit card numbers, social security numbers and other personal data, or even properties from you.

Keep in mind of the three-steps best practices when encountering any of the activities:

Check:

Search up the phone number, email address or URL online to see whether it’s legit or known scammer before responding
If the message appears coming from someone you know in real life, reach out to the person via another method or the circle of family, friends or coworkers to verify.
Keep an eye out for emails with misspellings and urging people to click a link.

Ignore:

Do not open any attachments unless you are expecting the file, document, or invoice and have verified the sender’s email address.
Do not click the link in an unsolicited text message or email that asks you to update, check, or verify your account information. If you are concerned about the status of your account, go to the company’s website to log into your account or call the phone number listed on the official website to see if something does in fact need your attention.
If something looks suspicious or smells ‘phishy’, ignore.

Report:

If You Spot a Scam Message, Report it to the Federal Trade Commission so they can help protect others.
If you were scammed, report to the Federal Trade Commission: What To Do if You Were Scammed
If you receive any suspicious phone calls or emails at UMass communities, UMass IT encourages you to please report any information security incident, any identified vulnerability in information assets, or any phishing attempts immediately to itprotect@umass.edu.
If you suspect a compromise or unauthorized access to UMass credit card information, contact the campus ecommerce representative immediately (pci@admin.umass.edu) to initiate the appropriate response, pursuant to the acquiring bank and card brand incident response procedures.

Common phishing or scam activities

Here are some common types of cyber security threatening activities you might encounter or have already encountered.

Common information security threatening activities with examples and prevention tips
Terms	Definition	Real Life Example(s)	Prevention Tip
Clone phishing	A scammer attempts to replicate a legitimate branded email you may have already received while sneaking in a malicious link or attachment. In some cases, the cloned email may contain something like “resending” or “sending this again” to make you think that it is from the original sender.	From: Supp0rt@amazon.co Subject: Resending Account Help Hi Madison, There has been an unauthorized login to your Amazon account. Please click here to secure your account now.	Keep an eye out for duplicate emails and check the sender’s email address before engaging with the message.
Spear phishing	Cybercriminals attempts to steal your information by impersonating a trusted source. An example of this would be a phishing email targeting an employee of a company by pretending to be their boss. In the email, the scammer may try to get the employee to give up private information that the scammer can later use to their advantage.	From: jenny@micros0ft.com Subject: Need Login Details Hi Wang, I need to check on some reports for a client but don’t have access. Can you send me your login ASAP???	Always double-check the sender's email address before responding. If the email appears to be from someone you know but you don’t recognize the email address, check with them before responding.
Scam	Fake communications from scammers posing as legitimate organizations in the tax, financial and consumer community, including the IRS and the states, or Amazon. Scammers often use persuasive or intimidating tactics to manipulate their victims for financial or material gain.	From: INTERNAL REVENUE SERVICE govirs-accnnt2023@gmail.com Subject: Claim your tax refund online "We cheked an error in the calculation of your tax from the last payment, amounting to $ 927,22. In order for us to return the excess payment, you need to create a E-Refund after which the funds will be credited to your specified bank. Please click below to claim your tax refund. If we are unable to complete within 3 days, all pending will be cancelled."	Keep in mind: The IRS never initiates contact with taxpayers by email, text or social media regarding a bill or tax refund. Keep an eye out for emails with misspellings and urging people to click a link. Individuals should never respond to tax-related phishing or click on the URL link. Instead, the scams should be reported by sending the email or a copy of the text/SMS as an attachment to phishing@irs.gov.
Spam	Spam is a term used in cybersecurity to describe any unwanted, unsolicited, and often irrelevant messages sent electronically in bulk, usually to a large number of recipients. While spam can be harmless promotional emails, it can also be a fraudulent or malicious scam, such as phishing or spreading malware.	“Your membership has expired. Click here to RENEW!” (you may have not ever interacted with this site) “FUND INVESTMENT PROPOSAL” “A special deal on xx credit card just for you”	Spam emails only become a serious cyber threat if you've committed any of the following actions: Downloaded any malicious files or email attachments. Responded with sensitive information (like your credit card or bank account numbers). Clicked on any phishing links.
Spoofing	A disguise used by someone to act as a trusted source in order to get access to personal information.	Email spoofing: Email address can be uber.support@services.com (fake) instead of uber@support.services.com (real) (the emails above are not actually real, just an example) Caller ID Spoofing: the Caller ID shown is close to one that you have in your phone, or a loved one’s. Website Spoofing: Let’s say you’re looking to buy a basketball jersey online. After searching around, you finally find the one you want. While going through the checkout process, you notice that the website seems a little off. Even though it has the branding of a well-known store, you see some blurry images and grammatical errors. This is an example of a spoofed site.	Before responding to an email, picking up a call, or purchasing anything online, double-check the source (sender’s email address, caller ID and the website URL) to confirm you’re responding to the official and legit one. Search up the URL, phone number on Google before clicking on it or picking it up: E.g if the website reads uber.support.net (fake), I search “uber support . net” (spaces are intentional) or just search “uber support” and can see that it is help.uber.com (real) Sometimes it’s easy to recognize that something is suspicious if you get an email claiming to be Uber or the IRS and it’s an address like: abklsjbwksucn@gmail.com
Phone Scam / Suspicious caller	A person, usually with malicious intent or selfish gain, is calling you and mentions something that you have no relation to (ending membership, didn’t pay taxes, threats, package held at the post office) and tries to get you to give up information. Phone scams are common, and they often prey on people's generosity or fear.	"Mom, I'm in trouble! Can you bail me out? Please don't tell dad! Send money to this detective directly: xxxxxxx"	Search up the phone number on Google when before picking up the phone call. Watch out for things only scammers will say: “Act now!” “Only say what I tell you to say.” “Don’t trust anyone. They’re in on it.” “Do [this] or you’ll be arrested.” “Don’t hang up.” “Move your money to protect it” “Withdraw money and buy gold bars” “Withdraw cash and give it to [anyone]” “Go to a Bitcoin ATM” “Buy gift cards”

Did you know?

In 2023, on average, there are 7,123 people per day reported scams in the United States.

Source: Federal Trade Commission (FTC) (Consumer Advice)