Don't be Phished

‘Phishing’ and ‘spear phishing’ aim to lure you into providing passwords, banking details or personal information, or to download attachments or click on malicious links that contain malware to infect your device.

Phishing - What to Watch out For

Phishing Examples

Reporting Suspicious Emails

Does it look Phishy?

Spear Phishing is targeted phishing where personal information gleaned from other sources, such as social media, is used to make the email appear authentic.

Phishing emails are becoming more sophisticated and can include logos and links to fake websites. Here are some warning signs to watch out for:

The email was unexpected. For example, the invoice came for a supplier you haven’t dealt with in a while or the payment amount differs from previous amounts.

The email asks for an urgent payment or threatens serious consequences if payment isn’t made.
The email was sent from someone in a position of authority, particularly someone who wouldn’t normally send payment requests.
The email address doesn’t look quite right. For example, the domain name doesn’t exactly match the supplier’s company name. Double-check by looking at previous correspondence.
The supplier has provided new bank account details.

If a message seems suspicious, contact the person or business separately to check if they are likely to have sent the message. Use contact details you find through a legitimate source and not those contained in the suspicious message. Ask them to describe what the attachment or link is.

Hackers rely on you being busy and trusting.

Phishing Email Examples

Below are some recent phishing emails that were picked up in our quarantine system - Note the sender's name & email address

The sender's name says Somerville but the email address is from '@notifications.service.outlookmobilemessages.com'. If you only saw the sender's name & the first half of the email address 'Noreply_Somerville.org.au' you may mistakenly consider the email to be genuine.

The email is intended to look like a notification for a voice mail message & get you to open the attachment. 'Somerville' is also used in the subject & body of the email to make it appear more legitimate.

The next email shows what looks to be a genuine Somerville email address.

The sender has spoofed our email domain '@somerville.org.au'. The only way to see where the email is actually coming from would be to have IT staff do some digging on the email's message properties

A more simpler way would be to go through the Somerville address book and you'll see that there is no 'noreply@somerville.org.au' in our system.

There are sometimes cases where genuine Somerville email addresses will be spoofed - our system is setup to prevent that so it is unlikely you will come across cases like that but if you receive any emails you're unsure of you can always check directly with that person & confirm if they are indeed the person that sent it.

Reporting Suspicious Emails

If you receive any suspicious emails you believe may a scam, report them as Phishing using the Report Message Add-in in Outlook
https://somerville.zendesk.com/hc/en-us/articles/360047878933-Report-Suspect-Malicious-Email

For more tips about staying safe online, visit becybersmart.nt.gov.au.