Learn how to recognize and report phishing

Last updated June 27, 2025

Phishing is a form of fraud where a scammer attempts to have you reveal personal financial or confidential information by posing as a reputable entity in an electronic communication. Many scammers try to bait you by urging you to open an attachment or to respond immediately by clicking a web link that appears official (with all the familiar logos or corporate phrases). Even if the request looks genuine, be skeptical and look for these warning signs:

How to recognize phishing attempts

  1. The message is unexpected and asks you to update, confirm or reveal personal identity information (e.g., full Social Security Number, account numbers, NetID, passwords, protected health information).

Your UW Madison Email account information needs to be updated to avoid deactivation. Click Update Email Account

  1. The message creates a sense of urgency.

Hello Your Email account will be De-activated shortly. To stop De-activation.

  1. The message may include an unusual “From” address or an unusual “Reply-To” address, it may even be a compromised “@wisc.edu” address. If you receive an email from someone you don’t normally communicate with (even if it’s from a @wisc.edu address), pay special attention to the other ways to detect its legitimacy.

Email showing unusual "from" address

  1. The message includes links that don’t match the name of the organization that it allegedly represents. For example, the URL “https://wisc.edu” could be slightly changed to read “https://wIsc.edu.”

email with a link that does not match the name of the organization that it allegedly represents.

  1. The message includes grammatical errors (although scammers are getting better at this).

Email message with grammatical errors

  1. The message is unexpected and offers an unbelievable job opportunity with great salary and perks. Yes, it’s too good to be true. This is a job scam.

Phishing email of a job scam

  1. The message impersonates a university leader or colleague. The email asks an employee to contact them for an urgent or important task. That “urgent task” is likely a request to perform an action that results in monetary loss to the employee or the university or to reveal confidential information. Always follow university policies when you receive an usual purchase request. This type of phishing is called a Business Email Compromise (BEC).

A phishing email where the sender uses a fake email address.

FAQs

This is an accordion element with a series of buttons that open and close related content panels.

Related docs

More Guides on Cybersecurity Topics (Source: it.wisc.edu)