Contents
The Vocabulary of Scams
Many people are familiar with the term "spam" - unwanted or junk emails - but some types of spam emails are more dangerous than others. You probably have seen emails or other messages that purport to be, for example, from your email administrator or PayPal but they just don't look quite right. They may be asking you to log in to update your information or to confirm that you haven't been compromised. (Reminder, Kellogg and Northwestern will never send you an email asking you to provide your password!)
These are examples of types of phishing - they are trying to "fish" the information out of you so that they can get your login ID & password. Since so many people use the same password on multiple different websites and email addresses, it's a safe bet that a phishing scammer can get far on one scammed password.
There is a specific type of phishing called spear-phishing. Scammers do their homework and target their phishing attacks to a few recipients and make it seem like it's from a supervisor, a dean, or other VIP.
Some hallmarks of spear-phishing scams are:
- Legitimate-looking sender email addresses
- "From" someone you know
- Friendly, short messages such as "You busy?" or "Stuck in a meeting, can you do me a favor?"
- If you respond to the initial email, you're asked to give credit card info or purchase gift cards for some seemingly legitimate purpose
Scams come from many sources
Scams don't always come via email - they can come in texts, in social media, in messaging apps, QR codes, and even via phone calls. The goal is always the same - to get your money or your access to valuable information.
Use the same guidelines when you get a suspicious message from any source. Our examples below are based on email, but the concepts work across mediums.
Protecting Yourself from Scams
Recognizing scams
- Learn to recognize scams and phishing attempts
- Recent phishing attempts at Northwestern University
- How to identify a fraudulent email scam (YouTube video)
- Business e-mail compromises (FBI.gov)
- Scam Spotter (backed by Google and Cyber Crime Support Network)
Vet unsolicited requests & be suspicious
- Does this sound too good to be true?
- Is the message pushing you to "take action now or else"?
- Does this sound like something the purported sender would ask you to do?
- Can you reach out to this person via other means?
- Is their "tone" and language similar to the person they say they are?
For an email, check the "from" email address
- Alias: What is before the @ symbol?
- Check the email address against a known-good email address (such as in the NU Directory or your personal contacts list)
- Kellogg email addresses can have multiple formats (firstname.lastname; firstname-lastname; f-lastname) and may include a number if there is more than one person with the same first initial/name and last name (e.g., bob.smith1 & bob.smith2, a-miller1 & a-miller2)
- Is the "northwestern.edu" before or after the @ symbol?
- Scammers try to make their email addresses look legitimate by including "northwestern.edu" in the email address
- Before the @? 100% not legitimate
- Examples of fake "northwestern.edu" email addresses: bob.smith.northwestern.edu@outlook.com; bob.smith.northwestern.edu@gmail.com
- Domain: What is after the @ symbol?
- ALL legitimate Kellogg email addresses end in either @kellogg.northwestern.edu OR @northwestern.edu
- Anyone can set their display name to match the name of someone you know
- Scammers with talent & resources can fake a domain
- Emails from non-Kellogg or non-Northwestern domains will be marked as "External" by Outlook
- Note the signs in a potential fake text messages as well
Recent scam trends to watch out for
- Gift card purchases
- Mentorship requests
- Payroll adjustment/authorization
- Password check
- Mystery shopper proposal
- Invoice/payment "replies" with documents attached
- Unsolicited shared documents
- Personal assistant "work from home" opportunity
- QR codes in public places
Next Steps
If you received a phishy email or text and did not click links:
- Forward the original email to KIS@kellogg.northwestern.edu as an attachment (see instructions in next section)
- Delete the email
If you received a phishy email or text and DID click links:
- Change your password (Use NUValidate for NetID passwords)
- Change passwords for any other accounts sharing the same password (and please, please, don't reuse passwords. Hackers use this as an easy way to get into your other accounts)
- Forward the original email to KIS@kellogg.northwestern.edu as an attachment (see instructions in next section)
- Delete the email
- Schedule a time with KIS to do a scan on your computer(s)
If you received a phishy email, text, or document and used your NetID/password to access a document or webpage:
- Do everything in the section above (e.g., change passwords...)
- In NUValidate, change your security questions and answers (scammers may have had access to these).
- Look in your Outlook Settings at Rules and remove any unexpected rules (scammers can put forwards or delete rules in here to extend their access).
- If you are employed by NU, visit MyHR, check your Direct Deposit, and ensure scammers haven't re-routed it to themselves.
- Contact KIS for assistance.
If you received a phishy message and provided credit card/bank info or bought gift cards:
- Contact your credit card company / bank
- Forward the original email to KIS@kellogg.northwestern.edu as an attachment (see instructions in next section)
Forwarding Email as an Attachment
Outlook (M365)
- Open Outlook on your computer
- Click to select the message you wish to forward
- In the Outlook ribbon at the top of the screen, click on the More icon and select Forward as Attachment
- Add your recipient and subject line, as well as any other relevant information in the body of the message and click Send
Outlook (web version)
- Sign in to Outlook
- While viewing the suspicious email
- click on the 3 dots ... at the top right of the message
- select Other reply actions / Forward as attachment
- Add your recipient and subject line, as well as any other relevant information in the body of the message and click Send