Information Technology Services (ITS)

Spear phishing are targeted emails to specific individuals. By gathering easily accessed, online information about you, such as name, job position, role at UofL or area of study, the attacker will use the data to their advantage in the email. The scammer will pretend to be someone who knows you or an entity with an unexpected need.

The goal of spear phishing is to steal sensitive information such as login credentials or infect your target device with malware. Hackers often send specialized targeted emails using a compromised email address or contact list to infiltrate their recipient’s system. Often the malicious content uses the scammer’s knowledge of your position to take an action that, ultimately, harms the institution or provides access to the university’s secure data.

Online social engineering targets you in the same manner that a con artist swindles a mark for money. Through the psychology of persuasion, the scammer gains your trust while you lower your guard and reveal personal info, divulge sensitive data or click on an attachment. A cybercriminal communicates with the victim (email, text) saying that they are from a trusted source – like your bank, UofL’s administration, etc. – and need you to take immediate or further action. Sometimes the email looks realistic with logos or appropriate signatures.

• Verify the sender! If it looks suspicious or you are not comfortable, don’t click or respond. Check on the authenticity of the message.
• Be wary of tempting offers or out-of-context urgent requests. Ask yourself if the sender would really contact you in this manner. Check the source.

Did you get a UL2FCTR/Duo authentication request that you did not initiate? UofL’s Duo or second factor service will never email, call or text you asking for a passcode or PIN. We don’t send SMS or text notifications without you first signing into a system.

• If you’ve gotten a Duo request that you didn’t initiate, deny the request. You should only get a prompt when you are trying to access a UofL resource that has UL2FCTR required.
• If you’ve gotten a SMS or text with a passcode that you didn’t request, auto-report it to your mobile device provider (ATT, Verizon, etc.) and delete it.
• If you get a fraudulent phone call, don’t press any keys or verify your identity, hang up. Block the number on your device.
• Always check the location of the push request (does it match your location?) and remember, avoid sharing Duo passcodes with anyone!

REPORT UL2FCTR fraudulent activity to ITS.

Phishing to your cell phone via text or SMS message is smishing. Vishing are scams that come as short, fraudulent phone calls. Working in a manner similar to phishing emails or social engineering, the smish or vish uses known or familiar sources to play on a sense of urgency – often bill paying, bank transactions, car warranties, package delivery – to get you to click or reply with information.

Smishing

• Communication via text or messaging apps to your smart phone or tablet that prompt you to open a link to a webpage or another app often hide malware that will infect your device.
• The smish might include a link to track a package or confirm a delivery, even though you did not order anything recently.

Vishing

• Sometimes fraudulent calls are made by actual people; other times they are done via robocalls. The scammers may even spoof phone numbers of real companies or individuals to deceive you.
• The scammer informs that you won a contest or have unusual activity on your bank or credit card. They will then ask for personal information or to access your account to check or receive a deposit.

Did you get a UL2FCTR/Duo verification prompt request that you did not initiate? UofL’s Duo or second factor service will never email, call or text you asking you to verify a separate prompt. We don’t push authentication notifications without you first signing into a system.

• Attackers will send or initiate a prompt to your Duo account with the intention of the legitimate user accepting it without paying attention to the listed location.
• Always check the location of the push request (does it match your location). If you’ve gotten a push request that you didn’t initiate, deny the request. You should only get a prompt when you are trying to access a UofL resource that has UL2FCTR required.
• If you get an unauthorized Duo prompt, it is possible that the scammer has tried to access a system with your personal email, userID and/or password. We HIGHLY suggest updating your UofL password via our Identity Management System immediately.

REPORT UL2FCTR fraudulent activity to ITS.

Scammers often use more than one method of attack – a phishing email with a nefarious link to a fake webpage that displays a dubious UofL sign in which initiates a Duo-looking message to accept a prompt. Yes, cybercriminals are devious and getting better every day.

With AI tools, simple browser extensions, webpages are easy to copy or recreate – so detecting the fraudulent ones is difficult. Scammers can steal a user’s UofL credentials and Duo login codes by redirecting recipients to a fake UofL login page. The phishing email and webpage steal UofL branding and use forged UofL email addresses to appear more realistic. This is also frequently done with Microsoft Outlook imagery, PayPal or other popular banking visual identifiers – the phishing attack states an urgent need to fix your account.

Nag, nag, nag to get you to say yes. Scammers will send requests over-and-over to annoy you into accepting one to make it stop.

• For emails, use the Report feature within Outlook.
• For text messages, the only answer is to report the number to your provider and block the sender each time. It is critical that you do not click to accept on any suspicious links or requests.
• For UL2FCTR / Duo prompts that you did not initiate, do not accept the prompt. Report Duo fraudulent activity to ITS.

Two-factor fatigue and email/text bombing are tactics where attackers flood a user with repeated requests to exploit the user's decreasing alertness due to exhaustion. Take time to think about what you are being asked to do and why before you act. Think twice before clicking within text messages or providing sensitive information on unsolicited inquires.

QR (Quick Response) code phishing, or quishing, is both social engineering and a multiple phishing attack in one that scams an individual into scanning a fake QR code in order to either redirect you to a bogus website or install malware on your device.

QR codes show up in emails but are often found publicly as printed for the ease of use in a situation. Be on the lookout for any of the following:

• Any unsolicited QR codes. Phishing emails and social media often feature these codes for scanning. Make sure that the code comes from a trusted source.
• The QR scan/redirect takes you to a spoofed site where the URL differs from the original or provided website address.
• Requests to enter sensitive information like login credentials or personal data. The site will steal information that you enter.