Protect yourself from email phishing attacks

October is National Cyber Security Awareness month, and the Information Security team is offering guidance to assist users in helping to keep the med center’s environment safe.

Nebraska Medicine and UNMC Information Technology Services uses many tools to help protect a user’s computer and the campus network from becoming infected, similar to getting a flu shot.

Follow these extra steps to help stop the spread of computer viruses.

  • Do not respond to an email (or click on a link) that asks someone to “validate your information,” then asks for IDs, passwords and other sensitive information. UNMC and Nebraska Medicine Information Technology Services will not ask for this information in an email.
  • Do not click on unknown links or attachments because these links can be disguised to make them appear legitimate.
  • Do not enter information in a pop-up.
  • Do not respond to or take actions on emails regarding urgent requests or wire transfers.
  • Emails with poor spelling and grammar are clues to scams. Delete them.
  • Do not send personal information in an email or through an unsecured website. Enter sensitive data only if the user trusts the website and if it has a lock icon in the URL.
  • Always check to see who the email is coming from. It is very common for an attacker to pretend they are someone known, such as a co-worker, manager or organization president. Do not respond to these emails. If a user believes the email is legitimate, contact the sender by a known phone number to verify the individual and request.
  • Use the “Report Phish” or “Report Suspicious” button in the Outlook application to report any possible phishing emails. Performing this action will help keep UNMC and Nebraska Medicine safe. Please note that there is a Microsoft button called “Mark as phishing” that is similar. Do not use this. Use the “Report Phish” button dedicated to UNMC and Nebraska Medicine 
  • After emails are reported, Proofpoint and Information Security Team will analyze and investigate. Users will not receive a follow up email unless Information Security needs additional information.