Email use

Email is not secure. It is like a postcard which can be read as it travels over the internet to the recipient. It is very easy to accidentally send confidential information to the wrong person.

Do

  • Carefully consider if sending confidential information by email is appropriate (e.g. an alternative, more secure, method is to send a link from a secure storage area).
  • When sending confidential information by email, clearly state 'confidential' in the subject line and protect the email by restricting access.
  • Be cautious and always think before you click links, open attachments, or download files in emails you receive, regardless of who sent them (for more information on malicious emails see 'How to spot phishing' below).
  • Forward any suspicious messages to spamtrap@uwe.ac.uk so IT Services can investigate new threats. Then delete the email from your inbox.
  • Remember, if an email is too good to be true, it probably is.

Don't

  • Click any links or attachments in emails, unless you already know what they contain.
  • Respond to suspicious email messages from:
    • Anyone, including IT Services, that ask you to confirm your password or personal information or demand an immediate response or threaten loss of accounts or services.
    • Unrecognised senders.

Who should I contact if I'm not sure?

More information

Scenarios

My device is encrypted.  Does this mean emails sent from my device are also encrypted?

No, email is not secure as it can be read as it travels over the internet to the recipient. Restrict access to the email or put the confidential information in a protected (encrypted) file and attach it to the email.

What is phishing?

Phishing is a form of fraud that includes malicious emails designed to gain personal information and may appear to come from a genuine source. Emails often include links to bogus websites or attachments, which appear to be normal files (e.g. Word, Excel or PDF) and are harmful.

How to spot phishing?

IT Services have technical controls in place to filter out spam before it reaches your inbox, but phishing techniques change and some will inevitably 'get through'.  

Example Phishing email #1 – Fake warning from IT

Phishing Email 1 Explained. Non-existent sender address. No personal greeting. Request to revalidate or confirm account details. No UWE specific information such as ITS contact details. Hovering over the link reveals a suspicious unknown web address (http://tinyurl.com/6emzvy3).

Signs that it is a phishing attack:

Phishing Email 1 Explained. Non-existent sender address, this email address does not appear in the Outlook address list. No personal greeting. Request to revalidate or confirm account details. No UWE specific information, such as ITS contact details or signature. Hovering over the link reveals a suspicious unknown web address (http://tinyurl.com/6emzvy3).

Example Phishing email #2 – Email containing infected document

Phishing Email 2. From: "Clare Harding" [purchasing@carterspackaging.com]. To: user.name@uwe.ac.uk. Subject: FW: Purchase Order 0000035394 customer 09221. Attachment: Purchase Order 0000035394.docx. Body text: Dear customer, Please find attached a copy of our order (reference 0000035394), your reference. If you have any questions regarding the purchase order please contact us using the details below. Clare Harding, Purchasing Manager, Casters Packaging Ltd, Packaging House, Wilson Way, Pool, Redruth, Cornwall, TR15 3RT. Fax: +44 (0) 1209 315 600. www.carterspackaging.com, purchasing@carterspackaging.com

Signs that it is a phishing attack:

Phishing Email 2 Explained. Sender is a real company. An internet search revels that they were the victim of a cyber attack that took control of their email systems. Malware can spread through infected office documents. Non-specific greetings. References to unknown financial transaction involving unfamiliar companies.

Example Phishing email #3 – Document emailed from government organisation

Phishing Email 3. From:gateway.confirmation@gateway.gov.uk. To: user.name@uwe.ac.uk. Subject: Your Online Submission for Reference 475/RA2949502 Could not process. Attachment: GB3370106.zip { Contains: GB3370106.pdf.scr}. Body text: WE could not process your Full Payment Submission. The submission for reference 475/RA2949502 was successfully received and was not processed. Check attached copy for more information. This is an automatically generated email. Please do not reply as the email address is not monitored for received mail.

Signs that it is a phishing attack:

Phishing Email 3 Explained. Email supposedly from government address to a work account. Poor grammar. File disguised as pdf but is actually an executable program. No personalised greeting and unprofessional structure. Reference to unknown financial transaction.

Example Phishing email #4 – Document emailed from UWE staff account

Phishing Email 4. From: other.name@uwe.ac.uk. To: user.name@uwe.ac.uk. Subject: Your documen. Attachment: Document7912.zip { Contains: document7912.exe }. Body text: To view your document, please open attachment.

Signs that it is a phishing attack:

Phishing Email 4 Explained. Poor grammar. File name as a document but is actually an executable program. No personalised greeting or explanation of attachment. No UWE specific user information, such as contact details or signature.

Back to top