The Catholic University of America

Avoid Phishing Attempts

Phishing is an attempt to acquire usernames, passwords, credit card or other personal information by pretending to be a trustworthy person or organization in electronic communications such as e-mail or messaging.

Phishing email messages often ask you to send your username and password in a response, or they may contain a link to a malicious web site under the guise of asking you to register to continue a service. These messages are often very realistic, sometimes even claiming to come from the university.  This article from Microsoft has a good example of an email phishing attempt: "How to recognize phishing email messages, links, or phone calls."

The university will never ask for your username and password in an email message.

Never provide your username and password in email.

The unversity uses an email security system that blocks the vast majority of messages containing phishing attempts and other malware. Occassionally, however, a few of these messages are delivered.

Please be alert for phisihing attempts when reading your email.

If you do receive a message in your university inbox asking for your password or other suspicious personal information, it is very likely a phishing attempt. You should not reply to it (even to complain), and you should never click any link in the message or open any attachments.

Instead, you should contact the computer Information Center and notify them that you have received a phishing message.

The Information Center will need you to forward the message to them, as well as the full message headers.  The section below describes the steps for obtaining the message headers using Microsoft Outlook or Cardinal Mail.

If you accidentally replied to a phishing attempt, please save the suspicious message and contact the Information Center immediately, as technicians can take steps to mitigate the risks to the university network.

How to send the full message headers

Email messages contain a set of technical headers used by the email program such as Microsoft Outlook.  Most email programs or web sites hide this information as it is not normally needed by you for reading email.

When you receive a phishing attempt, however, these headers contain important information that can assist the computer technicians in blocking these types of messages.  Please follow the steps below when the Information Center asks you to provide the full headers for a suspicious message.

Microsoft Outlook

To get the message headers using Outlook 2010, please use the following steps.

  1. Open the message containing the phishing attempt.
  2. Click the small diagonal arrow in the bottom right corner of the "Tags" section in the ribbon menu.
  3. In the resulting Properties window, highlight all the text in the "Internet headers" text box (you can do this easily by clicking text within the box and then pressing Ctrl-A to select all text).
  4. Copy the highlighted text by pressing Ctrl-C or by right-clicking the text and selecting Copy.
  5. Close the Properties window, and close the open phishing attempt message.
  6. Send a message to info-center@cua.edu describing the problem or referencing a support request ticket number, pasting the Internet headers you copied in step (4) above into the body of the message (you can do this by pressing Ctrl-V or by clicking Paste on the ribbon menu).

Cardinal Mail

To get the message headers using Cardinal Mail Google Mail, please use the following steps.

  1. Open the message containing the phishing attempt.
  2. Click the button containing the small down arrow found on the same line as the sender name and date of the message.  (When you hover over this button with your mouse, "More" is displayed.)
  3. Select "Show Original" from the list of menu items that is displayed.  The full headers open in another tab or window.
  4. Highlight all the text in this tab or window (you can do this easily by clicking text within the box and then pressing Ctrl-A to select all text).
  5. Copy the highlighted text by pressing Ctrl-C or by right-clicking the text and selecting Copy.
  6. Close the tab or window containing the full headers.
  7. Click Compose to send a message to info-center@cua.edu describing the problem or referencing a support request ticket number, pasting the Internet headers you copied in step (5) above into the body of the message (you can do this by pressing Ctrl-V or by right-clicking and selecting Paste).

More Information

How to recognize phishing email messages, links, or phone calls (Microsoft)

"Phishing" Fraud: How to Avoid Getting Fried by Phony Phishermen (U.S. Securities and Exchange Commission)

12 Steps to Avoid Phishing Attempts (Tech Republic)