Welcome to the newly designed Security site. Some content has moved: How-to guides and technical documentation have moved to IT Knowledge Hub (KB), and services are in the IT ServiceHub.
Phishing is an attack (either via email, text message, phone call, or DM) used to steal usernames, passwords, credit card information, Social Security numbers, and/or other sensitive data. In the age of AI, phishing messages can look very convincing.
How to Spot a Phish:
Unexpected Request or Too Good to Be True: If you get an unexpected email or one that’s too good to be true, STOP. Ask: Is it creating fear and asking you to click something?
Urgency: Scammers often create fear or demand immediate action; slow down and review the email before you act.
Check the Sender: Always hover over an address before replying. If it's from a Berkeley email, look the person up in the Campus directory and contact them separately (phone call, different email, etc.).
Report a Phish:
When you flag a phishing email in bMail, Google can automatically block it across campus. Reporting doesn't just clear your inbox; it protects fellow Bears from falling for the same scam.
Got a fishy email? Click the 3 dots at the top right of the message and select Report phishing.
For suspicious messages received by text, please take a screenshot and forward it to phishing@berkeley.edu.
Our office has received a number of reports recently of bogus offers for free or discounted convert tickets offered in UCB student platforms (discord, chatgroups, etc.).
We are seeing a spike in sophisticated tactics used to phish for credentials that are then used in concert with other methods to redirect direct deposit routing in UCPath.
