Phishing Attacks Target University Email Systems: How to Identify Fake Messages and Protect Yourself

What is Phishing?

Phishing is a fraud scheme where scammers impersonate legitimate organizations or institutions through email, social media, SMS, or messaging apps like WhatsApp to steal personal or organizational information. The success of these scams depends on making recipients believe the message is genuine.

Psychological Manipulation Tactics

Scammers exploit four psychological triggers that make people act before thinking:

Authority: Messages appearing to come from authority figures or official institutions naturally inspire trust and immediate obedience.

Urgency: Phrases like "Act immediately" or "Your account will be locked" pressure people to click without careful consideration.

Scarcity: Creating false fear of losing something ("Limited access" or "This offer expires today") pushes hasty action.

Reciprocity: Offering rewards or benefits in exchange for personal information exploits the human desire to return favors.

Common Phishing Patterns Reported at Universities

Pattern 1: Account Confirmation

Scammers send emails saying "You need to confirm your account by clicking this link." Legitimate institutions never request confirmation via email. Password changes should always be made through official portals.

Pattern 2: System Maintenance Alert

Fake emails claim "System maintenance or congestion detected. Please confirm your email by clicking this link." Real institutional maintenance notices are published on official websites and distributed through official channels only.

Pattern 3: Suspicious Activity Detection

Sophisticated phishing emails now include authentic-looking signatures, correct contact information, and legitimate-appearing links. However, hovering over links reveals the actual destination differs from what is displayed. The sender appears as "Mail Support" but originates from a compromised account.

How to Identify Phishing Emails

Check the Sender

Without clicking, hover your cursor over the sender's name to reveal the true email address. On mobile devices, tap the name to expand details. Many phishing emails appear to come from legitimate names but hide a different actual sender address.

Verify Links

The displayed text often differs from the actual link destination. Hover your cursor over links without clicking to see the real URL in the browser's lower corner or email client status bar. Watch for fake domain variations such as:

• fake-ufsc.br
• mail-ufsc.br
• ufsc.com.br
• ufsc-edu.br
• ufsc.br.suporte.net

The legitimate domain must be exactly "ufsc.br" or end with ".ufsc.br" (with the period).

Inspect Attachments

Pay close attention to file extensions (the last 3-4 characters of the filename). Executable files with extensions .EXE, .SCR, .BAT, .JS, or .VBS are almost certainly malware designed to damage or compromise systems. Be aware of disguised filenames like "PHOTOS.JPEG.EXE." The actual file type is determined by the final extension.

Evaluate Tone and Language

Unnatural wording is a red flag. Watch for:

• Poor translation quality (international scams entering your region)
• Excessive formality inappropriate to the context
• Unusual slang, abbreviations, or informality in official communications

With AI assistance, scammers increasingly produce grammatically correct and contextually appropriate text, making this warning sign harder to detect.

Question Unusual Requests

Legitimate institutions never ask via email for:

• "Confirm your password by clicking here"
• "Urgently transfer funds to this account to release payment"
• "Click the attachment to resolve a pending issue"
• "Update your registration data using this link"

What to Do If You Click a Phishing Link

If you suspect you have clicked a malicious link, take these steps immediately:

1. Change Your Password Immediately: Update your password for the affected service right away.

2. Change Other Passwords: If you use the same password on other services, change those as well (though using unique passwords on all accounts is strongly recommended).

3. Report to Your Institution: If using an institutional email account, report the incident as quickly as possible. The time between clicking and reporting determines the extent of damage: reporting within minutes becomes a statistic; hiding for weeks becomes a full incident.

4. Alert Your Department: Inform colleagues that others likely received the same phishing email and may need to be cautious.

How to Report Phishing Incidents

Most institutions operate under non-punitive education policies, so reporting will not result in sanctions. Rapid reporting is essential.

• If you can authenticate: https://chamados.setic.ufsc.br
• If you cannot authenticate: https://atendimento.setic.ufsc.br
• For questions: Contact support helpline