Phishing is the top attack method for social engineers. It’s how they steal data, defraud people of money, and spread malicious software. As a general rule, no matter the context of the message and no matter who sends the message, treat all requests for confidential information or money with skepticism. It’s important to always remember to think before you click – at work and at home.
• Are you familiar with the sender?
• Does the message contain poor grammar or misspelled words?
• Are there any suspicious links or unexpected attachments?
• Does the message offer unrealistic promises, like large sums of money?
• Does it plead with you to click on a link, download something, or send personal information?
• Does it threaten you by saying an account has been hacked or that you face legal action?
For additional guidance on how to spot a phish, view this informational graphic (PDF).
Here are the three primary ways to report a phishing attack:
Additional options available if the recommended option is not available: