NEW THREAT: Phishing Scam (asking people to click on something that mimics OSU Webmail). DO NOT CLICK or REPLY!

Wednesday, November 5th:

For most of 2008, a number of e-mails have been circulating from sources claiming to be from the Ohio State Technical Support *support@osu.edu*, Subject:OSU UPDATE TEAM or Exciting Upgrade To OSU Email Accounts.

One very recent example takes great effort in trying to add legitimacy to the message by linking to a facsimile/forgery of the OSU Webmail site.

If you entered your information at this fake site, immediately contact the OIT Support Center by dialing 8-HELP or 614-688-HELP so that they can help you secure your webmail account.

Always check the address bar at the top of your web browser and ensure you're at the proper site!

The most recent phishing attack also makes use of a deceptive web page, trying to appear as an OSU site to trick you into providing your OSU Internet Username and password. Also, make sure you've established a secure connection.

OSU's official webmail site is located at http://webmail.osu.edu

Example of the most recent message - Do not follow the link!

From: Ohio State University [mailto:osunews@osunews.edu]
Sent: Wednesday, November 05, 2008 7:19 PM
To: name.#@osu.edu
Subject: news

Please read our latest news and information:

http://webmail.osu-edu.net/uwc/?auth

Ohio State University

OIT expects these attacks to continue because senders expect financial gain by accessing your account to send mass mail or having your personal information. If you ever have a question about the legitimacy of an e-mail or have fallen victim of this type of attack, please call 688-HELP(8-HELP) for assistance.

Many Phishing e-mails ask people to reply with their osu.edu e-mail account information and password, sometimes along with personal information like a birth date. Some other qualities of these attacks may include a non-OSU reply-to address, poor grammar and incomplete or improper OSU branding. These are all qualities to look out for.

These messages are not from OIT and, furthermore, OIT should never ask you for your password via e-mail or phone. These e-mails are phishing attempts and not legitimate requests. You should never reply to these e-mails and never give your password to anyone.