A new email phishing scam targets various communities, including UVM, in an attempt to convince people to divulge their Network IDs and passwords. Please ignore these requests.

This week, some UVM community members received email messages from "MIcrosoft Outlook," and with the subject "Please re-configure your Microsoft Outlook again !" (full text below).  It tells the recipient to click on a link to a malicious web site that undoubtedly solicits personal information, such as email username (Network ID) and password. These solicitations, and others like them, are phishing scams.  Do not reply.  Microsoft and numerous other sources confirm that it is a scam. 

If you have already replied to one of these messages, or a similar message, please change your UVM Network ID password immediately, using the secure online form at uvm.edu/account/, or hackers will have complete access to your confidential UVM information. Please call the Help Line at 656-2604 if you need assistance.

University of Vermont officials should never request your password, and you should never provide your password to someone who asks for it.

What is a Phishing Scam?

The Anti-Phishing Working Group (APWG) explains that phishing "attacks use both social engineering and technical subterfuge to steal consumers' personal identity data and financial account credentials."

APWG offers useful tips to help you avoid becoming a victim of phishing or pharming:

• Be suspicious of any email with urgent requests for  personal financial information
• Don't use the links in an email to get to any web  page, if you suspect the message might not be authentic
• Avoid filling out forms in email messages that ask  for personal financial information
• Always ensure that you're using a secure website  when submitting credit card or other sensitive information  via your Web browser
• Consider installing a Web browser tool bar to help  protect you from known phishing fraud websites
• Regularly log into your online accounts
• Regularly check your bank, credit and debit card  satements to ensure that all transactions are legitimate
• Ensure that your browser is up to date and security  patches applied
• Always report "phishing" or "spoofed" e-mails

Visit the following resources to learn more about phishing and pharming prevention,  scam advisories, and to report yourself as a victim of phishing or pharming:

• Anti-Phishing Working Group
• Privacy Rights Clearinghouse - Identity Theft:What To Do if It Happens to You
  
• Federal Trade Commission - New FTC Videos Help Consumers Spot Phishing Scams
• Department of Justice - Special Report on Phishing
• Government Computer News - Is a new ID theft scam in the wings?

What Does the Latest Phishing Scam Say?

Phishing scams are successful when they sound authentic, and are often customized to appear as though they come from a trusted source.  They often include a mix of real and bogus email addresses and web links (URLs).  Phishing scams often appear to come from UVM, although of course they do not.  While there are likely to be several variations on each scam, here are some the messages received by UVMers recently.

Please re-configure your Microsoft Outlook again !

From: MIcrosoft Outlook<cbzntg@microsoft.com> Date: August 5, 2009 4:23:59 AM EDT Subject: Please re-configure your Microsoft Outlook again ! Reply-To: cbzntg@microsoft.com Please re-configure your Microsoft Outlook again. Please click on the link below to setup. http://b384a.static.pacific.net.au/user/skin/a/ww.htm