IT security tip: Slow down. Look closer. Think before you click.

October is Cybersecurity Awareness Month, and while cybercriminals constantly change their tactics, one thing remains true: Many attacks begin with a single click.

In fact, more than 90% of successful cyberattacks start when you click/select an unfamiliar link in a phishing email. A phishing scheme is when a link looks legitimate, but it’s a trick designed to have you reveal your passwords, credit card numbers, or other sensitive information. In addition, a phish might be an attempt to get you to run malicious software, also known as malware.

Whether the message arrives through email (phishing), text (smishing), voice call (vishing), social media, Microsoft Teams, or another collaboration platform, attackers often rely on curiosity, uncertainty, doubt, urgency, or fear to persuade someone to click a malicious link. The message may appear to come from a co-worker, supervisor, vendor, delivery service, financial institution, or even a trusted university organization. But appearances can be deceiving.

The good news is that one simple habit can stop many cyberattacks before they start. Pause and verify the source before clicking.

Unexpected messages deserve extra attention

Attackers often target people when they are busy and distracted. A message arrives unexpectedly with a link and a request to:

• Review a document
• Reset a password
• Update account information
• Approve a payment
• Open an invoice
• Sign a form
• View a package delivery notification
• Access shared files

In many cases, the request creates a sense of urgency, encouraging the recipient to act immediately, without verifying the source, to avoid a negative consequence.

When a message arrives unexpectedly, take a moment to ask yourself:

• Was I expecting this message?
• Do I recognize the sender?
• Does the request seem unusual?
• Am I pressured to act quickly?
• Is there a negative consequence for not acting quickly?
• Can I verify this request through another method?

A few seconds of verification can prevent hours, days, or even weeks of recovery from an IT security incident.

What makes a link suspicious?

Cybercriminals frequently disguise malicious links to look trustworthy.

Be cautious when:

• The displayed text does not match the link destination
• The sender uses an unfamiliar email address
• The message contains spelling, grammar, or formatting errors
• The request seems out of character for the sender
• The message asks for passwords, multifactor authentication codes, or sensitive information
• The link uses a shortened URL or unusual web address
• The message creates urgency and discourages verification

University IT support teams will never ask you for your password or Duo Mobile code through or by any communication channel.

Even if a message appears to come from someone you know, their account may have been compromised. When in doubt, contact the sender to verify the request through a separate channel.

For example:

• Call the sender directly
• Start a new email instead of replying to the suspicious message
• Contact your local IT support team
• Navigate directly to a known website instead of clicking a link

Never feel pressured to respond immediately simply because a message claims something is urgent.

You are an important part of the university’s IT security efforts

Technology helps identify and block many threats, but attackers continue to develop new techniques designed to bypass automated defenses. Your awareness and caution provide a critical layer of protection for university systems, research, patient information, student records, and other institutional data.

The next time an unexpected email, text message, or Teams message arrives with a link, take a moment to pause.

Slow down. Look closer. Verify the request. Think before you click.

 

Node 4 Search