Information Technology

Beginning with the shift to remote operations, there was an increase in phishing and email scams globally. Webster University Information Technology would like to send this reminder to be cautious in your daily email communications. One scam that's been distributed is the popular Are you available/Gift Card email scam.

Subject lines vary but may include “Quick request” or “URGENT.” They appear to come from a valid Webster University faculty or staff member when viewing the “From” information, however, the email address itself is not an @webster.edu address (example: staffname.webster.edu@outlook.com or staffname1@gmail.com). These scammers have used a variety of actual faculty, staff and department names in both the “From” and email signature. The body of the message varies, but may include text such as “Are you available?” or “Please send me your cell phone number.”

When individuals reply to these emails or send their phone numbers, the scammers then engage in requests for money and/or gift cards. These emails are fraudulent emails and are not coming from any legitimate Webster constituent. Please do not reply to these messages or send any money/gift cards.

As a reminder, any email that comes from outside of the @webster.edu domain is delivered with the following caution message in a banner at the top of the email that reads “CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.” These messages should also serve as a good flag in determining the legitimacy of an email sender.

While Information Technology does take measures to filter spam and scan emails at the server level and is taking additional action to block these specific messages, these can never be 100% effective in blocking all suspicious emails. Please take a few moments to review the security awareness topics below on phishing and email scams to help ensure your personal data remains confidential and secure.

Phishing is an attempt (usually in the form of an email, web page or phone call) to steal your personal information. These messages often appear to come from a legitimate source and request that you respond with personal information, such as passwords, download an attachment, or direct you to a spoofed website that mimics a login page, or otherwise requests you to divulge login or financial account details. Attachments and phishing web pages may also have the ability to transfer malicious software onto your computer meant to capture login information. The perpetrators behind these scams try to induce panic by threatening account closure or email loss if you do not take action. Their ultimate goal is to steal your account information, finances or even your identity. Please be diligent in protecting yourself from these scams.

Phishing attempts can take several different forms. The most common are ones that ask you to verify your account information for some reason. For instance, they may say there was a security compromise that they need to verify your account is still in use, that you’ve reached your quota, etc. These messages will often say if you don’t respond, your account will be closed or locked. Webster University and all reputable businesses and organizations will never send messages requesting you provide logon and/or financial account credentials. Please treat ALL such messages as fraudulent.

Other phishing attempts can appear to come from a manager or president of an organization asking you to download an attachment with important information (or view a link). These can often contain malicious software or keystroke loggers meant to capture login credentials.

In general, be on the lookout for these red flags that often indicate a phishing message:

• Incorrect spelling and/or bad grammar.
• Threats of account shutdown.
• Promises of money and/or requests for money and bank account transfers.
• Requests for private or sensitive information.
• Unexpected email attachments.
• Unexpected/unsolicited job opportunities.
• Spoofed links/web pages, such as links that appear to go to a legitimate website but by hovering your mouse over the link, you see they actually point to a different (and malicious) web page.

You are your best resource to prevent becoming a victim of phishing. Here are some general best practices:

• Keep logon information private and secure. NEVER provide these details to others, especially via email.
• Choose passwords that contain a mix of upper- and lowercase letters, numbers and special characters.
• Read email messages in plain text.
• Never open attachments or click on links that you aren’t expecting. Hover your mouse (without clicking) over links to verify the URL matches the text in the email link. If a message appears to come from someone you know, phone that person directly and ask if they sent you the message/file.
• Verify the “From” address matches the sender.
• Only logon to secure web sites. These are sites that begin with “https://” and should show an icon of a closed lock in the address bar. Always logon to your accounts by typing the URL directly into your browser. Links in phishing messages will often take you to a spoofed web page that looks like the real one.
• Regularly clear your browser cache and cookies. Refer to your browser’s help menu/documentation or contact the IT service desk for assistance with this.
• Always error on the side of caution.

If you receive a phishing message, please delete it right away and do not click on any provided link or attachment. If your deleted messages go to a secondary “Deleted Items” folder, be sure to delete the message from there, as well, to permanently remove it.

If you are unsure of the legitimacy of an email or if you have replied to a phish by providing your logon details, clicked on any of the provided links or downloaded an attachment in one of these messages, please contact the IT service desk as soon as possible for further assistance. You can reach the service desk by calling 314-246-5995 or toll-free at 866-435-7270. You can also reach the Service Desk via email at support@webster.edu.