IAS warning on email scams and other phishing activity - August 2023

Dear Faculty, Members, Visitors, and Staff,

As we start the countdown to our Fall term here at the Institute for Advanced Study, we are reminded of the risks of scams and phishing as they arrive on campus. Recently, a large volume of phishing scams have come to many of our inboxes. We really appreciate everyone's concerted effort to notify us of the phish so that we can block its effectiveness of stealing your credentials and data.

Here is an example of one of the scams with the title, "Action Required: You Have Received New Payment". Here are a few things to notice about this email that should identify it as a scam.

A phishing email from American Express indicating that a Merchant Credit of $3500.56 was added to your account.

The first is the subject. Notice that the subject is written in a way to evoke emotion. This is an example of something that is "too good to be true". If it starts a physical response (e.g. heart beats faster), that should be your first sign that it may be too bad or too good to be true. This should be a sign to immediately stop, think about the situation, before you decide to connect. Also, they spelled "received" incorrectly; our spammers should be embarrassed!

The second is the "from" address. This one is subtle, but you'll notice that although it claims to be from American Express, the domain is @xchanger.com. That doesn't look like American Express to me.

Lastly, if you hover over the link it does not take you to an American Express page. All these things together should help you identify that this is a false message. If you have a suspicion, contact your helpdesk for more information before you act on the message. Remember, there should not be an urgency in email, or if there is, you should feel empowered to take your time to respond.

For more information, take a look at these following blog posts.

Phishing
Spotting a scam email (aka a phish)
October 2022 Security Awareness Seminar for this and more tips on keeping yourself secure.

Thank you and safe computing!

Brian Epstein
Institute for Advanced Study
Chief Information Security Officer

Blog