How not to be a victim of an email scam

Massey's Information Security team are concerned by the sudden increase of staff usernames and passwords that have been compromised by sophisticated email scams. Over the past three weeks:

• 21 staff usernames and passwords have been compromised
• 180,000 spam emails have been sent from Massey staff email accounts.

Staff should immediately contact the ITS Service Desk if they've accidentally given their Massey username and password to anyone. 

Most staff accounts were compromised by phishing attacks. Phishing emails are easy to believe and open because they appear to come from legitimate and trustworthy sources, such as the recipient's colleagues or banks. They often contain links to well-designed websites, where the recipient is asked to enter their details.

Please be aware that no one at Massey would ever ask for sensitive information over email, nor would a bank.

Scammers are writing more sophisticated emails. They are now using attachments that look harmless to open, like Word documents, to install ransomware or viruses on the recipient's computer.

If an email seems random, call the sender to confirm that it's legitimate before opening the email, especially if there is an attachment. Otherwise, delete it.

The Information Security team are always working to limit these attacks at a technology level, but it is challenging to balance preventing these attacks, with permitting the legitimate use of services like email and web browsing.​

More safety advice can be found in Massey’s Information Security Manual or by searching for 'spam' in AskIT.