Security Threat Awareness

ITS strives to provide the UIS campus community with the most up to date information about current security threats and good practices on what you may need to do to reduce your risk of a security incident.


What is phishing?

Phishing is a technique identity thieves use to steal your personal information, usually passwords or financial information. Like a fisherman using a lure to hook a fish, identity thieves try to lure you into giving up personal information by making what looks like a legitimate request from an organization you trust. These might look like they are from a bank, credit card company, or even the University. Unfortunately, phishing scams can be highly effective.

Want to know if the UIS really sent you that email? Call the ITS Client Services Help Desk at (217) 206-6000 and ask!

Common Phishing Types


  • Hackers impersonate a real organization or person to obtain your login credentials. You may receive an e-mail asking you to verify your account details with a link that takes you to an imposter login screen that delivers your information directly to the attackers.

Spear Phishing

  • Spear phishing is a more sophisticated phishing attack that includes customized information that makes the attacker seem like a legitimate source. They may use your name and phone number and refer to the University in the email to trick you into thinking they have a connection to you, making you more likely to click a link or attachment that they provide.


Whaling is a popular ploy aimed at getting you to transfer money or send sensitive information to an attacker via email by impersonating a real University employee. Using a fake domain that appears similar to ours, they look like normal emails from a high-level official, typically the President, Chancellor, Provost, Dean or CFO, and ask you for sensitive information (including usernames and passwords).

Shared Document Phishing

You may receive an email that appears to come from a file-sharing sites such as Box, Dropbox, or Google Drive alerting you that a document has been shared with you. The link provided in these emails will take you to a fake login page that mimics the real login page and will steal your account credentials

Rules of Thumb

To avoid being phished, follow these rules of thumb:

  • Keep your password private.
  • Only click on or download email attachments from people or companies you know.
  • Don’t click on links, visit official companies (University of Illinois, Chase Bank, etc.) websites by typing their URL directly into a browser.
  • Read carefully. If an email has a lot of misspelled words and really bad grammar, it’s probably a scam.
  • Strangers don’t send millions of dollars to random people on the internet (i.e., you).

Dissecting a phishing email

Phishing is often very easy to spot.

Phishing emails are often completely out-of-the-blue emails that ask you to click on a link and enter your password, may have a lot of misspelled words, or want you to download an attached picture, Word document, or PDF.

It’s probably a phishing scam if:

  • The email is completely out of the blue and sounds like you’ve been having a conversation with them this whole time.
    • You remember when you purchased something or talked to someone. The scammer hopes you don’t remember.
  • The email asks you to “update your account” by clicking on a form and entering your password, credit card number, or account number.
    • Banks, stores, credit cards, and the University of Illinois will never ask you for sensitive information (passwords, account numbers, credit card numbers, etc.) over email.
  • The sender’s email address is the name of a legitimate company + common email provider. Example:
    • Banks have their own domains. They don’t send emails from common email providers like or
  • The email has a generic greeting like “Dear User” or “Dear Most Honorable Friend and Confidante.”
    • Legitimate companies personalize their greetings to their customers.
  • There are misspelled words and bad grammar.
    • Scammers tend to be lazy. They don’t take time to proofread.
  • A few words are turned into a link instead of a big, long web address.
    • Hover your cursor over the link without clicking it to see where it’s really taking you, or even more secure, visit the company site directly and find the information you seek.

Report Phishing Attempts:

Information Technology Services utilizes the same process for reporting phishing attempts as is does to report SPAM as these are both variants of email abuse. Please use the instructions found on the ITS Email Abuse page to report phishing events.