Skip to main content

Spot fraudulent emails (phishing)

Confirm the source

  • Some fraudulent emails (phishes) targeting Cornell are listed at IT@Cornell’s Phish Bowl.

  • Some trusted emails from departments are listed at the Verified Cornell Communications page.

  • If the request appears to be from a Cornell department, contact the department with information you find when you look up its number at Search Cornell.

  • If the email isn’t listed on the Verified Cornell Communications page, and you don’t get a timely response from the department, contact the IT Service Desk for help.

  • If it appears to be from a service outside Cornell, such as your bank, PayPal, eBay, or a credit card service, look up their contact information using a trusted source (the 800 number on the back of your credit card or by searching for the service’s official website at a trusted search engine).

Video: Email Phishing 101

Common scams

As criminals gain access to more information about people, Internet fraud attempts become more sophisticated and narrowly targeted.

  • Messages claiming to be from a Cornell office or official, requesting personal information and passwords.

  • Invitations to see photos of family or friends, greeting cards, or pleas for disaster relief assistance.

  • Bogus URLs may link to imitations of legitimate, popular web sites, such as eBay, Amazon, or personal banking sites. Cornell’s CUWebLogin page has even been mimicked.

Obvious clues that MAY indicate an email is a scam

Beware a false sense of safety. The lack of any of these signs does not guarantee that an email is legitimate!

  • It's poorly written. It may be written with ALL CAPS, have spelling and grammar errors, or it may seem fragmented.

  • It asks you to send personal information (Social Security, credit card, bank account, passwords, date of birth, address, phone numbers, etc.).

  • It tries to scare you into reacting by creating a sense of urgency with exclamation points, words like “immediately,” or threatening to close an account.

  • It offers something that's too good to be true.

  • It has a From address that doesn’t make sense or doesn't match the domain where it really came from. See Forged Email Addresses.

  • It requests money for disaster relief or another cause.

Hover over URLs before you click

Don’t assume that what you see is where you’ll go when you click.

In many browsers and email programs, hovering over a link (without clicking) lets you see the ACTUAL URL for the link. If the underlying link is different, be very cautious. As an example, hover over the link below and look for the real link to display in your browser (often in the bottom left corner):

Also be cautious of any link that doesn’t clearly indicate where it leads, like links that say (hover over these to see what's hidden beneath):

Watch out for forged email addresses

Email links are easy to check. See how to read web addresses (URLs in email and online).

From addresses in emails are more complicated to check, but they are very EASY to fake. Anybody can make their From address look like it came from someone you trust, like, so if you don't feel confident after checking email links, see how to check email headers.

Last updated 03/10/2015


Back to main category list


Type your security question:

Browse all Security articles