Phish / Fraud Email

What is phish and when should you be suspicious of divulging private information?

Phish Tank: Samples

The Mantra

Be skeptical of any request for private information.

As a general rule, don't give out private information unless you are sure to where, and to whom, you are giving them to. This means any private information (passwords, bank PIN, SIN, etc.) over any communication medium: web form on an unfamiliar site, telephone conversation with someone you don't know, Email, etc.

Practical Rules

The mantra is a great rule of thumb, but lacks the clarity of concrete actions. This is by no means a comprehensive list, but will get you a long way from getting suckered:

  • Do not give out passwords or any private information by Email.
  • Do not give your PHAS account password to any website that does not end with .phas.ubc.ca. Do not give your UBC CWL password to any website that does not end with .ubc.ca. (Check what your browser reports the URL as.)
  • Do not give private information over the phone unless you know who the other person is, or if you called them yourself using contact information you have obtained by independent means.

What is Phish?

Phish is a term that refers to fraudulent Email that instructs you to divulge confidential information such as passwords, PIN numbers, credit card numbers, or personal identity information like SIN numbers in order to impersonate you and take resources that belong to you. Phish Emails are written by criminals with bad intentions -- don't be a victim.

Examples of Phish

A common example is a message notifying you that your Email account needs to be reset (e.g. increase storage quota or maintenance or some other reasons), and that you must supply your Email address and password to continue to use your Email account. They may ask you to reply to an unfamiliar Email address, or enter into a web form. These fraudsters are trying to gain control of  your Email account to send out more phish or spam.

Another common example, the Nigerian 419 scam, has the sender pose as a bank or government official requiring your assistance to carry out a financial transaction. In return, they wil cut you in on part of the proceeds. These senders are trying to exploit you and eventually take your money.

There are many other examples, but the one thing they have in common is that they want you to give them information that they can ultimately use to take something from you. Don't do it -- [repeat the mantra].

Characteristics of Phish

Phish usually share serveral traits, but even if none of these traits are present, [repeat the mantra]. Fraudulent Email is evident by what it tries to make you do, not by what it looks like.

  1. Generic salutations (e.g. "Dear sir","Webmail User").
  2. Lack of credible contact information (no local phone numbers or real names) to verify the contents.
  3. Spelling and grammar mistakes.
  4. Weird formatting and word usage (e.g. gratutious upper casing, inconsistent spacing, etc.)
  5. Sender/recipient Email address or web URLs that are unfamiliar or lie totally outside our domain (ubc.ca).
  6. A tone of urgency (e.g. "Do it now!", "You may lose Email privileges!").

What should you do when you receive a Phish Email

Receiving the Email is harmless, but you should never respond to, nor act upon information within, such Email.

Neither the PHAS, nor the UBC, IT staff will ever ask you for your password, nor any confidential information via Email. If in doubt, please contact the IT staff using trusted chennels (known Email address, phone number, in person).

If you have responded to Email like this, please contact the IT staff immediately. Also, it is a good idea to change your password as soon as you can -- fraudsters only need a few minutes to take advantage of the information. Then [repeat the mantra] until you are out of breath.

Phish Tank

If you have received what you suspect to be a fraudulent Email, please forward the entire Email (full headers and body) to the IT staff. We'll probably respond by asking you to [repeat the mantra].

But before you report it, take a look at our 

Phish Tank

which has all the samples that have been previously spotted or reported to us. If you see a copy here, it's not necessary to report it again to the IT staff.

More information

  • Wikipedia entry (Phishing)
  • Comedy Phish Skit: this is a humorous take on phish and spam in general, but it highlights the observation tha tif the content of spam was conveyed in the same analogous method as in person. You would have no trouble discerning it as fraudaulent.