Phishing is a constant and increasingly sophisticated threat to the campus community. Use this guide to understand the risks, identify fraudulent activity, and take immediate action if your account is compromised.
Table of Contents
What is Phishing?
Phishing is a type of attack used to steal information or money. These attacks occur through email, phone calls, texts, instant messaging, or social media. Attackers target your personal information: usernames, passwords, credit card numbers, and Social Security numbers. They also seek intellectual property, research data, and institutional information.
Phishing goals include:
- Financial Theft: Modifying direct deposit information or draining bank accounts.
- Identity Theft: Opening new accounts or running up credit card charges.
- Fraudulent Purchasing: Tricking victims into buying gift cards or performing unauthorized work.
- Malware Distribution: Tricking victims into clicking malicious links or installing spyware.
Who to contact if your credentials are compromised
1. Change your passphrase immediately: If you still have access to your account, reset your passphrase at mycalnet.berkeley.edu. See the CalNet Account Management Guide (KB0015607) for instructions.
2. Report the incident: Officially Report a Security Incident via the Information Security Office (ISO) website.
3. Verify your identity: To regain access to a locked account, you must show a government-issued photo ID via Zoom or in person.
Contact the appropriate team:
- If you cannot access your account: Contact security@berkeley.edu.
- If CalNet has locked your account: Email calnet@berkeley.edu.
- To open a general ticket: Call 510-664-9000 (Option 1, 1).
High-Risk Login Reporting
Email the Information Security Office at security@berkeley.edu immediately if your potentially compromised account has any of the following characteristics:
- You access protected data (UC PL4) as part of your normal duties (e.g., ImageNow, PeopleSoft, HCM, Payroll, BFS).
- You suspect University (non-personal) documents containing protected data are stored on your workstation.
- You have file shares (network/mapped drives) mounted on your workstation that contain protected data.
- You use accounts with privileged access (Admin, Superuser, DBO) to other systems.
- You store usernames or passwords in plain-text (unencrypted) on your device.
- You work with Research data regulated by IRB, CPHS, or other Data Access Agreements.
How to identify a Phishing scam
The Golden Rule: Never give out personal information in an email. No credible institution, bank, or university department will ever ask you to re-enter sensitive data via an email link.
- Suspicious Phrasing: Watch for urgent calls to "verify your account," "update your records," or threats of "account suspension."
- False Branding: Scams often use official logos and professional-sounding text. Always scrutinize the sender's actual email address and the destination of any links.
How do I report a Phishing or suspicious email?
Reporting suspicious emails can dramatically reduce the impact of an active attack. For detailed guidance, see: How to Report Phish.
Using the bMail (Google) Web Interface:
- Open the message.
- To the right of the 'Reply' arrow, select More (three vertical dots).
- Select Report phishing.
If you are unable to log in to bMail, forward the message to phishing@berkeley.edu or call the ITCS Service Desk at 510-664-9000.
Tell-Tale Signs of Compromise
- Colleagues report receiving unexpected or spam messages from your account.
- You suddenly cannot log in because an attacker has changed your passphrase.
The Best Defense:
- Keep all software and browsers up-to-date according to the Minimum Security Standards for Networked Devices.
- Never reuse your CalNet passphrase for non-university websites.
- If you receive an ISO Security notification regarding exposed credentials, follow the instructions in KB0015409 - Credential Exposure FAQ.
What can I do to avoid Phishing attacks?
Take an active role in protection by following the tips in the Fight the Phish campaign.
- Verify the Sender: Ensure the email address matches the organization it claims to be from.
- Check Security Certificates: Ensure websites use
https://and display the padlock symbol before entering data. - Verify Offline: If you are worried about an account, call the organization using a trusted phone number from their official website.
- Antivirus: Maintain current software and active antivirus protection.