Stop, Think, Verify: Recognizing and Reporting Phishing

Assumption

This article is written for students, faculty, and staff at any Virginia's Community Colleges institution. No special access or system permissions are needed to follow the guidance here.

The Three Rules

  • Never share your password.
  • Never share your MFA code.
  • Never approve an MFA request unless you initiated the login yourself.

If You Think You Have Been Phished

Act right away if you clicked a suspicious link, entered your college credentials into an unfamiliar website, approved an unexpected MFA request, or shared your MFA code:

  • Change your password immediately.
  • Report the suspicious email.
  • Contact your college's IT Help Desk as soon as possible.

What Is Phishing?

Phishing is a deceptive scam used by a criminal to entice you into clicking a link to a scam website, opening an infected attachment, approving a malicious request to log in, or giving away personal information like your username, password, and your Multi-Factor Authentication (MFA) code.

Phishing emails can appear to come from legitimate sources, including your college, Microsoft 365, financial institutions, shipping companies, and even close personal contacts.

Remember: No legitimate college employee, Microsoft representative, or IT support technician will ever ask for your password or MFA code.

Common Scams That Target Students

  • Alerts about fake financial aid
  • Fake tuition refund requests
  • Notices that your student account or email is being disabled
  • Fake employment or work-from-home opportunities
  • Fake scholarship offers
  • Requests to send gift cards or cash
  • Package delivery delay notifications containing phishing links
  • Unexpected Microsoft 365 login requests

Warning Signs

Think carefully before clicking anything in an email, and ask yourself:

  • Was the email expected?
  • Is the sender's email address authentic?
  • Is there an attempt to create a sense of urgency or instill fear?
  • Does the email ask me to click a link, download an attachment, or verify my identity?
  • Are there spelling and grammatical errors in the message?
  • Is there anything about the email that seems strange or too good to be true?

Protect Your Account

  • Verify unexpected requests using a known phone number, website, or email address instead of information provided in the suspicious message.
  • Never give out your password to anybody, including a person who says they work for your college's IT department or for Microsoft.
  • Never respond to an unexpected MFA request, and never provide your MFA code to anybody. College IT staff will never request your MFA code or ask you to approve a login attempt you did not make.
  • If you get an unexpected MFA request, deny it immediately. It may mean someone has your password and is trying to access your account.
  • Do not click links or open attachments in emails and messages from unknown senders.
  • Keep your computer, phone, and applications up to date with the latest security updates.
  • Use strong passwords for all your online accounts.

Awareness and Educational Resources (external)

Want to improve your cybersecurity skills? These free resources can help you recognize online threats, protect your personal information, and develop safer habits while studying, working, and interacting online.

Learn how to recognize and avoid phishing scams through this NIST-aligned cybersecurity awareness course. Topics include identifying suspicious emails and messages, checking links safely, recognizing fake login pages, and reporting scams before they cause harm.

Learn practical strategies for staying safe online from the U.S. Department of Education. This resource covers common online threats, protecting personal information, digital citizenship, and building safe habits for online learning and everyday internet use.

Learn practical cybersecurity skills you can use every day. This free course covers phishing awareness, password security, social media safety, mobile device protection, and ways to safeguard your digital identity and personal information. password = homecourse

Stay informed about the latest cybersecurity threats and trends with SANS OUCH!, a free monthly newsletter written for everyday users. Topics include phishing scams, AI-related risks, password security, privacy protection, and other practical tips for staying safe online.

We Are All Part of Keeping Our College Secure

Cybersecurity is everyone's responsibility. Taking a few extra seconds to verify an email before clicking a link or approving an MFA request helps protect your personal information and keeps our college community safe.

Print Article