Recent phishing attempt prompted dozens to provide IU logins to online scammers.
Dozens of IU faculty and staff recently provided their IU usernames and passphrases to scammers after a phishing email appeared to come from the “IU Payroll Department.” The phishers immediately began using the stolen credentials to access IU systems, causing significant disruption to those affected and the IT staff.
In most cases, IU’s Two-step Login (Duo) authentication system blocked scammer access to Payroll and HR, but a few people approved their Duo login even though it was unexpected, and scammers gained access to IU systems.
A few phishing reminders:
- Phishers always have bait words to try to invoke a click. Topics such as Payroll, Policy, COVID-19, or Tax Refund are chosen to solicit a rapid action. Slow down to check the source before clicking.
- Before clicking on links, look for official IU domains before the first slash in the address (iu.edu/, iupui.edu/, iuk.edu/, indiana.edu/, etc.).
- Look for the [External] email tag in the subject line, or in the message header.
- Look for the trusted footer on official communications and marketing emails.
Remember: it’s always phishing season, even during a pandemic.
The College of Arts