How to recognise phishing emails - and what happens if you click on a link

That is how the hack at Maastricht University began. On that occasion, the network was infected with ransomware. Teaching staff, researchers and students could no longer access the IT systems to retrieve their data and documents! Everything had been encrypted. Fake emails often look deceptively real. If you follow the tips below, however, you will find it easy to sniff them out. Find out more on Phishing & Ransomware - about the hack at Maastricht UniversityExternal link and test your knowledge with the quiz.

How to recognise and check phishing emails

• Were you expecting an email from this person/organisation? Are you suspicious? Call the purported sender, but never use the telephone number in the email!
• Does the email ask you to do something urgently, such as pay an invoice or click on a link to check or supplement your details? Be even more cautious! Remember: no UvA systems administrator will ever ask you for your password.
• Check whether the email address is the purported sender, organisation or company’s official email address. The domain name (everything that comes after the @ sign in the email address) should match the organisation or company’s website URL. You can check the email address by hovering the mouse pointer over it, without clicking. If the email is fake, the email address will contain a variation of the organisation or company’s actual name (in which the I has been replaced by an L, for example)..
• Check the link. Only click on a link in an email if you know for sure that the website URL is genuine. You can check this by hovering the mouse pointer over the link, without clicking. This will show you the URL. Does this look suspicious? Enter the URL at checkjelinkje.nlExternal link or scamcheckExternal link to check whether it is genuine or not.
• An official website URL will contain the company’s name, followed by a full stop and the domain .nl or .com.
• A padlock icon means that the connection is secure, but is no guarantee that the website is safe.
• Emails from addresses ending in @e.uva.nl or @e.hva.nl are safe. The UvA uses these subdomains to send newsletters by email

See the infographic 'Check de link' (pdf) for more details and tips on recognising fake email address and website URLs.

• Check the file extension. This is the suffix at the end of a file name (the letters after the full stop) that indicates what type of file it is. The following file extensions are suspicious: .exe, .zip, .js, .lnk, .wsf, .scr, .jar. Never switch on macros.

Have you received a phishing email at your UvA email address?

• Send the suspicious email as an attachment to servicedesk-icts@uva.nlExternal link. We will update the spam filters to make sure this fake email no longer comes through.
• Delete the phishing email.

Have you clicked on a link or attachment in phishing email by accident?

• Switch off your internet connection immediately.
• Report what happened to the ICT service desk.
• Perform a virus scan and change your passwords, because malware is capable of forwarding your passwords to criminals.
• Have you entered your UvAnetID password on a fake website? Report this to servicedesk-icts@uva.nlExternal link and change your password immediately.

Tip: Test how good you are at recognising phishing emailsExternal link