Spot a phishing scam? Here’s how to report it

Phishing scams aren’t always easy to spot. While suspicious emails once stood out because of obvious spelling mistakes or unusual requests, today’s scams can look and sound convincing. They can arrive through email, text messages, phone calls, direct messages and even video calls.

The good news? You don’t have to be a cybersecurity expert to help stop a scam. Knowing what to look for, avoiding suspicious messages and reporting them promptly can help protect you and others in the K-State community.

Know the different types of phishing

Phishing is a type of scam that tries to trick you into sharing personal information, clicking a malicious link or giving someone access to your accounts or devices. Scammers often use fear, curiosity or a sense of urgency to get you to act before you have time to think.

Here are a few common types to watch for:

• Email phishing: Unsolicited emails that claim there’s a problem with an account, a billing issue or an urgent request that needs your attention.
• Smishing: Phishing attempts sent through text messages.
• Vishing: Scams that use phone calls or recorded audio to trick you into sharing information.
• Spear phishing: Highly personalized messages designed to target a specific person or organization.
• Whaling: Targeted attacks aimed at senior executives or other high-profile individuals.

Although these scams use different methods, they often have the same goal: to get you to act quickly without stopping to question the request.

How to report a suspected phishing email

If you receive a suspicious email, don't click links, open unexpected attachments or respond to the message. Report it instead.

K-State students, faculty and staff can report suspected phishing emails by sending the message, including its original email headers, to abuse@k-state.edu.

Not sure whether an email is a scam? It's better to report a suspicious message than to ignore a potential threat. Reporting helps K-State identify possible scams and take steps to protect the campus community.

For more information, including instructions for reporting a phishing email, visit K-State's phishing scams webpage.

What if you've already clicked a link or shared information?

First, don't panic. Acting quickly can help limit the damage if you think your K-State account or computer has been compromised.

Here are some steps to take:

• Change your password immediately. If you've reused that password for other accounts, such as banking, health care or retirement accounts, change those passwords, too.
• Contact IT for help. If you suspect your computer has been compromised, disconnect it from the network by turning off Wi-Fi or unplugging the Ethernet cable. Contact your system administrator or the IT Service Desk at 785-532-7722 or 800-865-6143 for help checking for malware. Don't power off the device unless instructed to do so.
• Check your account settings. Review your email forwarding settings to make sure they haven't been changed. Visit your eProfile page to verify your alternate email address and reset your password.
• Check your email folders. Look in your Sent and Drafts folders for messages you didn't send. Delete suspicious drafts and let anyone who received a scam email from your account know what happened. Use a method other than email to contact them.
• Watch your financial accounts. Review bank and credit card statements for suspicious activity. Continue monitoring them over time, since scammers may misuse personal information long after an initial incident.

If you believe your K-State account or device has been compromised, don't wait to ask for help. Contact the IT Service Desk for assistance. Quick reporting can help prevent a small problem from becoming a bigger one.

Stay alert and help protect one another

October is Cybersecurity Awareness Month, but protecting yourself online is important all year long. Scammers continue to find new ways to gain people's trust, and even a seemingly legitimate message can be part of an attack.

Before clicking a link or responding to an unexpected request, pause before you act. Be cautious of messages that demand immediate action, ask for passwords or personal information, or request unusual payments.

And if something doesn't seem right, trust your instincts. Don't respond. Report it. Help protect the K-State community.

Learn more about online safety and other ways to protect your information on K-State's cybersecurity website.