On this page:

• If you receive a suspicious email
• If you responded to a suspicious email
• Never email your personal or financial information
• Review your credit card and bank account statements
• Use caution with tax information
• Use email etiquette
• Use security best practices

 

There are several steps you can take to protect against phishing:

If you receive a suspicious email

• Do not reply, even if you recognize the sender as a well-known business or financial institution. If you have an account with this institution, contact them directly and ask them to verify the information included in the email.
• Do not click any links provided in these emails (or cut and paste them into a browser). This may download viruses to your computer, or at best, confirm your email address to phishers.
• Do not open any attachments. If you receive an attachment you are not expecting, confirm with the senders that they did indeed send the message and meant to send an attachment.
• Do not enter your personal information or passwords on an untrusted Web site or form referenced in this email. 
• Report any suspicious messages that claim to be from UMass Amherst or contain a suspicious attachment or link to itprotect@umass.edu.
• Delete the message.

If you responded to a suspicious email

• Contact your financial institution. Report the content of your email and your actions to the security or fraud department.
• File a police report. Contact the UMass Police Department at (413) 545-2121 or your local police department.

If you have already provided your IT Account information in response to a phishing email, your account may be disabled (all accounts that display signs of suspicious activity will be frozen). It is critical that you:

• Contact the IT Service Desk to report the incident and get your IT Account reinstated (if applicable).
• Change your IT Account password immediately in SPIRE. If your IT Account has been disabled, you will create a new password when you re-activate your account.
• Change the passwords to all online accounts that may have been compromised.
• Report the message to the Federal Trade Commission (FTC) through their online fraud report form and to any organization impersonated in the email.

Never email your personal or financial information

Email is not a secure method of communicating sensitive information. Remember that legitimate financial institutions never ask for sensitive information via email.

Review your credit card and bank account statements

The best way to monitor activity on your financial accounts is to carefully inspect your credit report every year. Federal law requires the nation’s major credit reporting companies to give everyone a free credit report every 12 months. Once you have your report, look for inaccurate information or unfamiliar accounts.

Check your bank and credit card accounts for any suspicious activity or unauthorized charges. Sign up for online statements if you do not already receive them to get the latest information.

Use caution with tax information

Tax-related fraud can occur when someone accesses your personal information, such as your social security number. The Internal Revenue Service (IRS) does not initiate contact with taxpayers through email, text, or social media to request personal or financial information. Visit the IRS website to report tax-related phishing scams.

Use email etiquette

To ensure that your email isn't mistaken for an infected message:

• Always include a clear, descriptive subject for your email.
• Consider using an email signature (your name, contact information, etc) at the end of your email.
• If including an attachment, describe what it is and why you are sending it in the body of your email.

Use security best practices

• Use a unique password for each of your online accounts. Many people reuse a favorite password for multiple accounts, but if one of these accounts is compromised, they will all be at risk of data breach.
• Run a full virus scan of your computer every month. To detect the latest viruses, you must use a current version of your anti-virus software and keep it updated. 
• Update your device's operating system with the latest security patches, including your mobile operating system. Enable automatic updates to receive security patches as soon as they are released.
• Keep your software updated, especially your web browsers and mobile operating system.
• Only use approved storage applications for sensitive data and institutional information. Third-party applications like DropBox or a personal Google account are not appropriate storage or transmission methods for institutional information. See Where can I store or share my data? for more information.
• Do not "jail-break" your smartphone while you are a member of the university community and connect to the campus network. "Jailbreaking" or "rooting" a mobile device opens security holes and circumvents the device’s built-in security controls, making your phone much more vulnerable to viruses and malware.