Summary

Here is a small checklist you can use as a quick overview to determine if you have received a phishing email.

• Are you being asked to divulge information such as user ID, password, account number, credit card number or TAN? This should raise a red flag, especially if you do not have an account with the originator. (-> look a little more closely)
• Your first reaction to unknown originators should be suspicion.
  Since originator addresses can be falsified, the originator of the email may still appear to be known to you (i.e. it-support(at)tum.de). Pay attention to discrepancies in the writing style and grammar.
• Phishing emails frequently have links leading to websites where you are asked to enter personal data. If you are suspicious, please mouse over the link (don't click) and check the status bar (usually at the very bottom of the window) to see where the link actually leads to. In phishing emails, the displayed text almost always differs from the actual address. Similar spellings (i.e. www-tum.de) are often used to lure you into the trap.
• If the link and text are identical, double-check if the link goes to a familiar page.
• Some phishing emails will ask you to respond via email with personal access data.
• Pay attention to the language. Flawed German or English points to a phishing email in connection with at least one of the above-mentioned criteria.

Note: As the test demonstrated, even legitimate emails can exhibit one or more of the characteristics listed above. What's important is that you maintain a critical eye, but do not overreact; otherwise important emails may be lost.

Preventive measures

If you suspect you have received a phishing email, we recommend the following course of action:

• Never respond to a phishing email and never divulge personal information.
• If you are uncertain, we maintain a list of known current phishing emails. Perhaps you found your email on the list?
• When in doubt, forward the email to it-support(at)tum.de. You will be informed whether it's a phishing email or not.
• If you have already divulged some kind of data, immediately change the affected password. If this password is used in other places, change it for each system.