Recognizing Phishing Mails

Many dangers lurk in the internet...

Swindlers try to get hold of your access data (e.g., your username/LoginID and password) using phishing emails. Once they can get into your account, they can use it for further fraudulent activities.

If you divulge your access data, the “phisher” has full access to your account – all your emails and all other data in the University network.

The account which has been broken into is then misused to send spam, phishing emails or virus-carrying emails in the name of the legitimate user. That damages the reputation of our SMTP server – which can lead to other email providers refusing to accept emails from the University of Tübingen. That harms all users of the University network.

We explain below how to recognize the majority of phishing emails. Please report suspicious mails or mails you are not sure about. Send them as an attachment to postmasterspam prevention@uni-tuebingen.de

Emails can be forwarded as an attachment in the following ways:

• Outlook (Windows): The selected email can be forwarded as an attachment using the keyboard shortcut CTRL + ALT + F.

• Outlook (Mac): Right-click on the email and select “Forward as Attachment”.

• Thunderbird: Right-click on the email and select “Forward and Redirect” / “As Attachment”.

• Webmailer: Right-click on the email and select “Forward” / “As Attachment”.

Subject lines such as "Warning/ Warnmeldung", "account upgrade/ Konto-Upgrade", "mailbox full/ Mailbox über Größenbeschränkung" are meant to make the message sound important.

Usually, the email contains a threat (in poor German or English) to close or delete the account. This is meant to make you respond immediately – without taking time to think.

Click on the images to enlarge.

You can easily see that this email was not really sent from "webmaster@uni-tuebingen.de" and that the reply goes to an external address.

How do I identify the actual sender address of an email?

• Outlook (Windows): Hover the mouse over the sender’s name – the full email address will be displayed.

• Outlook (Mac): Click on the sender’s name to view the full email address.

• Thunderbird: In the opened email or the preview pane, hover the mouse over the sender’s name to see the address.

• Webmailer: Hover the mouse over the sender’s name – the full email address will be displayed.

The University IT center (ZDV) never asks for your password via email!

Expressions like "F-Secure" and "password secure/ Passwort ist verschlüsselt" are meant to give the appearance of security. This is a sham!

Even though a "uni-tuebingen.de" sender address was used, this email did not originate

webmaster@uni-tuebingen.de.

Sender’s addresses can easily be falsified.

As in the first example, the answers go to an external address.

This phishing email tries to lure unsuspecting users with a link to a form in which you are supposed to enter your access data. In the webmailer you can easily see the quota status (circled in green).

This is an example of a form linked via a phishing email.

The source locator (URL) indicates that this is not a University of Tübingen web page.

This is an example of a form created by the phisher using Google Docs. The data is transferred securely (https) – but not to the University of Tübingen.

Browsers mark encrypted links in various ways (e.g. on a colored background, with a “locked” symbol), but this only means the data is encrypted when it is sent. You must check the addressee if you transmit sensitive data!