Congratulations, You Have Spotted a Phishing Attack!
Good job, you are doing your part to protect yourself and Grand Valley. By not entering your credentials, you have prevented potential harm to your identity and to the organization itself.
The GVSU Phishing Assessment Program is a part of the annual cybersecurity training helping GVSU gauge the awareness around identifying phishing emails. Our goal is to meet or exceed the industry standard click through rate which is 10% or less.
The most recent GVSU phishing email is shown below with the areas highlighted that are clues to help you understand what to look for in identifying phishing emails.
If you are unsure about the validity of any email, forward the email to the IT Security at phishing@gvsu.edu for evaluation.
GVSU Phishing Email Sample
Clue 1
The subject line suggests that your account needs attention but doesn’t explain why. Phishing emails often use vague subjects related to account security to encourage you to open the message. While this alone doesn’t indicate phishing, it’s a reason to look more closely at the email.
Clue 2
The email claims to be from Microsoft Teams, but the sender’s email address doesn’t belong to Microsoft. Cybercriminals often impersonate trusted organizations using unfamiliar email addresses. Always check the sender’s actual email address rather than relying on the display name.
Clue 3
The message asks you to verify your Microsoft Teams account without explaining why verification is necessary. Unexpected requests to verify your account or provide login information are common phishing tactics. If you’re unsure whether a request is legitimate, access the service directly rather than following links in the email.
Clue 4
The email asks you to click a link to verify your Microsoft Teams account, but the link leads to a website that isn’t associated with Microsoft. Before clicking links in unexpected emails, hover over them to check their destination. If the website doesn’t match the organization supposedly sending the message, that’s a strong warning sign.
Remember
Phishing emails don’t always contain spelling mistakes, obvious threats, or urgent deadlines. They can look professional and appear to come from familiar services. Always examine the sender, question unexpected requests, and inspect links before clicking.