We recommend everyone familiarize themselves with these all-too-common (and all-too-often successful) attempts to defraud people online.  If you receive an email you think is fraudulent, you can mark it in Gmail as phishing or forward it to iso-staff@humboldt.edu [1] so we can check into it.  If you believe you've been the victim of a scam, please contact the University Police Department.

Update on Phishing and Spam Emails 

Despite all our warnings, some HSU faculty, staff, and students are still clicking on and/or responding to fraudulent email messages (although more that 50% fewer of you than in February of this year - so that's good news). When you do interact with fradulent emails, you are handing your HSU User Name and Password over to the scammers, who then use them to generate even more fraudulent email. The more they do this, the likelier they are to hit gold - access to banking and credit card information, social security numbers, health insurance data - all of which they can sell for a lot of money. 

ITS sent the following test-phish in September 2018 - did you/would you have spotted these clues?

It is VITALLY important that you keep your HSU User Name and Password safe and NEVER share it with anyone.

HSU will never ask you to provide your password, social security number, or any other personal information by email. If in doubt, do NOT respond to suspicious email, and do NOT click on any links in suspicious emails. Make use of the Gmail and Outlook spam and phishing reporting tools and forward suspicious emails to help@humboldt.edu [2].
 
Any of the following characteristics is a potential indicator of a fraudulent email:

• You are asked for sensitive information  (for example, "Click here to verify your username and password")
• The message contains spelling or grammatical errors, or strange wording  (for example, thank you, from trusted administrator)
• The email is threatening (for example, if you don't do this, your account will be turned off or deleted)
• The email directs you to a slightly incorrect web address (for example, by asking you to visit http://www.humboldt.com/account instead of humboldt.edu)
• The message appears to come from an unknown or untrusted sender (for example, from administrator@humboldt.com [3])
• The email contains unexpected/inaccurate content (for example, "you've exceeded your email quota")
• The message is generically addressed  (for example, "Dear HSU customer")
• You are asked to download something (for example, "Click here to get the necessary virus update file")
• You are asked to act urgently (for example, "You must click here immediately to avoid having your account terminated")

Looking for a House or Apartment on craigslist?  Be Careful.

During peak rental season, we regularly see fake rental offers on craigslist. Many of these take the form of an alleged landlord copying information about actual homes for sale from reputable real-estate web sites and posting them on craigslist as rentals, using the same pictures and description, typically for a low monthly rent (plus security deposit).

The fake "landlord" typically responds to email inquiries with the following. Any of these is a red flag and you should not give this person money without thoroughly checking them and the property out.

• An apology about the "late response" and a brief description of themselves and their new job in a far-away area for the next few years
• A request to ignore the "For Sale" sign in the yard, because s/he initially planned to sell, but changed her/his mind
• An explanation as to why the rent is so low - to show they are not "after the money", but rather searching for a good tenant who will look after the house as if it were their own
• A rental application form, usually in clear text, towards the bottom of the email.

If you are planning to rent via a craiglist ad, please follow the following common-sense guidelines:

• If a deal sounds too good to be true ... (hopefully you know the second part by now)
• Never deal with anyone advertising on craigslist who you cannot meet in person
• Never send personally identifiable information to anyone via email 
• Google the address in the ad. You may find the same house for sale on legitimate real estate websites
• Never enter into any financial arrangement on craigslist using a money wiring service or agree to exchange documents/money/keys via a courier
• Always ask for a walk-through before agreeing to rent any house or apartment.

Please contact HSU's Information Security Office at x3815 if you have any questions or would like a second opinion on a "great deal" you came across.

Harassing Phone Calls

Harassing or obscene phone calls - threatening language, heavy breathing, silence on the other end of the line - can be a frightening experience. They’re also against the law in California, so call the police if this happens to you. Provide as much information as you can about the caller:

• Gender and estimated age
• Manner of speaking, accent, speech impediment
• Date and time of call(s), caller ID
• Background noise, signs of intoxication
• Content of call

The phone company can also set up a trap or trace to track down the offender; this is best done in conjunction with law enforcement as the information will be given to them, not you. If the caller can’t be tracked down, your best course of action is probably to change your phone number.

Other ways of discouraging these types of caller:

• Just hang up – eventually they’ll likely get bored and stop
• Let all your calls go to voicemail and leave a greeting along the lines of "I'm sorry we can't come to the phone right now, but you must leave a message. We are receiving 'annoyance calls'. If you do not leave a message we will assume you are the 'annoyance caller' and this call will be traced".
• Spoof the caller by picking up and saying something like "Operator this is the call" and hang up or say "trap" the time and date and hang up.

Do not disclose personal information when called by someone you do not know. Only list your first initial and last name in the phone directory or have an unlisted number.

Children should be instructed to never reveal information to unknown callers and to let all calls go to voicemail unless they recognize the caller ID. Don’t include your number in your voicemail greeting.  

Unwanted calls

While not a disturbing or potentially dangerous as harassing calls, unwanted (spam) calls can be a considerable nuisance. Some phone companies have a policy on dealing with these; call your local phone company to find out what their policy is.

The most effective and easiest way to prevent unwanted calls is to register your home and/or cell number(s) with the National Do Not Call Registry operated by the Federal Trade Commission (FTC). There are still a lot of junk mail faxers in operation, too, so office fax machines should also be registered. Go to www.donotcall.gov [4] and follow the instructions to register all the numbers you want to protect, and calls should stop after 30 days.

Questions?

If you have any questions or concerns regarding fraudulent emails or unwanted phone calls, please contact the Information Security Office at security@humboldt.edu [5] or call them at x3815 (x5555 to reach the University Police Department in an emergency).