Many university email users receive phishing messages on a regular basis. The purpose of these scams is to persuade people into disclosing their user account information, passwords, or e.g. their credit card information. This information is used to carry out cyberattacks.
Quick help
Learn how to act correctly!
In these instructions, you’ll learn
- how to spot a phishing message
- what the consequences of phishing can be
- how to respond correctly, if your details have fallen into the wrong hands
- how to avoid online scams
- how to report phishing and scam messages
You can find further instructions on the Detailed instructions tab.
Example of a phishing message
The image below shows a screenshot of a message that deceptively appears to have been sent by the university. The university’s logo appears at the top of the image, and the signature reads IT Helpdesk with its contact details. The ‘CLICK HERE’ link within the text directs the user not to the university’s website, but to https://docs.google.com, which is a phishing page designed to look like the university’s login page.
See more examples on phishing messages on Flamma's information security page (requires login).
Detailed help
How to identify a phishing message
- The University IT staff or IT Helpdesk will never ask for your user account information via email!
- Messages prompting you for your password or asking you to log in to your account quickly are always scams.
- Some of the phishing messages contain a link to a page where the user should allegedly log in with their username and password to check their user information or update it. Often these messages will claim that the user's email quota is full, or that failure to fill in the requested information will lead to the inactivation of the user's email account.
- Check the target address of the link: Hover your cursor over the link, but don't click it. The address will be shown in the bottom part of the screen or as a tooltip. If the address does not seem authentic, the message is most probably a fake.
- If you have any reason to doubt the authenticity of a message, don't open any links it may contain. Please ask the Helpdesk instead.
- The University does not send its users direct links to pages asking for user information or passwords.
- If you are targeted by phishing messages, please contact the University of Helsinki IT Helpdesk. Only report attempts to acquire your password.
- Never let anyone else use your user account or password!
You can check the validity of your username via the MyAccount service (myaccount.helsinki.fi).
Consequences of phishing
Phishing may have serious consequences. Phishers almost always try to scam you for money or otherwise make a profit from the usernames they have phished. Online criminals have used phished usernames at least for the following purposes:
- Sales of usernames – university usernames make it possible to access large amounts of data.
- Money transfer scams by impersonating the owner of a phished username.
- Identity thefts using the information accessible with the username.
- Hijacking of e-mail boxes and blackmailing in order to restore them.
- Spamming, resulting in the sender’s address being put in the recipient’s blocklist.
If you suspect your personal information may have been compromised
Please also report the matter to the IT Helpdesk. With their help, you can ensure that your login details are no longer used for malicious purposes.
Reporting junk mail
With the help of these instructions, you can report phishing and junk mail:
Example of a phishing message
Video instruction
Give feedback
The instructions site of the University of Helsinki's IT Helpdesk helps you with IT-related issues related to your work. Let us know how we can improve our instructions. We greatly appreciate your feedback!
How would you improve these instructions?