To strengthen communication and enhance cybersecurity awareness across our campus community, the Information Security team is proud to introduce “The Phish Files,” a new, dynamic resource for identifying and combating phishing attacks.

The Phish Files serves as a central hub where students, faculty, and staff can access real examples of phishing attempts targeting members of our campus. By reviewing these phishing scams, users can stay informed about the latest tactics used by cybercriminals.

What’s Inside The Phish Files?

• Current and Past Phishing Attempts: Real-world examples of phishing emails reported by campus members, complete with detailed breakdowns to help users recognize suspicious patterns.

• Cybersecurity Articles: Informative content about best practices for online safety, insights into how phishing attacks are orchestrated, and updates on emerging threats.

• Tips and Tricks: Practical advice for spotting phishing emails, protecting sensitive information, and safely navigating the digital landscape.

Why “The Phish Files” Matters

Phishing attacks are a growing threat to individuals and organizations worldwide. By creating The Phish Files, the Information Security team aims to empower the campus community with the knowledge needed to recognize and avoid these malicious schemes. This proactive approach helps safeguard not only personal information but also the university’s data and resources.

Get Involved

The Phish Files isn’t just a resource—it’s a community effort. If you receive a suspicious email, forward it to phishfiles@montclair.edu so our experienced team members can analyze it and add it to the archive. Sharing your experiences helps others stay one step ahead of cybercriminals.

The truth about cyber threats is out there, waiting to be uncovered. Stay informed, stay alert, and help us protect our campus. Don’t let cybercriminals abduct your data—explore the today and take control of your online safety!

To our Campus Community,

����vlog is adopting Google Drive and Forms as our standard for secure file sharing and collaboration. File Hawk will no longer be available and there will be no access to existing files.

What To Do Next?

• Review instructions for file sharing and creating file upload forms and folders for departments Secure File Transfer – Google Drive.
• Seek Assistance: Have questions or need help? Reach out to the Service Desk at itservicedesk@montclair.edu or call 973-655-7971, option 1

Thank you for your cooperation and support while we make this shift.

Beware Fake Travel Deals

Stay cautious of emails or sites offering unbelievable travel bargains. They may lead to fake booking pages aiming to steal your information.

Summer Job Offers & Internship Scams

Scammers target students and job seekers with enticing emails offering summer employment or internships. They may request personal details or upfront payments for training materials.

Package Delivery Scams

During summer sales, scammers pose as courier services in emails or texts, urging recipients to click a link for package tracking or pay a delivery fee.

Fake Contests & Giveaways

Beware of emails or social media messages claiming you have won a summer contest or giveaway. They may request personal details when you click a link to claim the prize.

Charity & Disaster Relief Scams

After natural disasters like hurricanes or wildfires, scammers create fake charity emails and websites to solicit donations.

For more information on cybersecurity, please visit: /information-technology/security/��

Protecting your adventures, one click at a time!

Travel Lightly

Limit the devices you bring on your trip. The more electronic devices you bring, the more risk you open yourself to.

Enable 2FA or MFA

Before you jet off, ensure your accounts are doubly secure!

Pause, THINK, Post

Think before posting on social media while traveling! It’s safer to share your adventures after you’ve returned home to avoid potential security risks.

Update Software Before You Go

Update all your software devices before you hit the road! Keeping your software up-to-date is essential for a safe and smooth travel experience

Travel Wise: Secure Your Devices

Keep your information safe on the go by adding strong passwords to your devices. It’s an essential layer of security while traveling!

There has been a recent surge in cyber attacks targeting campus communities across the country. To ensure the safety and security of your accounts and personal information, here are some security recommendations:

1. Never Share Your Personal Information

• Authentication Credentials (username and password)
• Date of Birth
• Home/Billing Address
• Banking Information

As a reminder, ����vlog will never request sensitive information via email. Please delete any such emails immediately.

Smishing is when scammers send fake texts to trick people into giving away personal information like passwords or credit card numbers

Examples of Smishing

Attackers will use an unknown number to text you requesting personal information, providing a suspicious link or stating there is an urgent matter.

How to Handle Smishing

Ignore and Delete!

If you receive one of these texts you can report it to the Federal Trade Commission. You can also copy the message & text it to 7726 (SPAM) so that your wireless provider can spot & block these attacks.

Avoid Being a Target

• Don’t put personal information online. Remember, you don’t know who has access to it.
• Never text personal information to anyone.
• If you’re unsure if a text is legitimate, contact the company / persons an alterative way.

Starting Wednesday, Feb 28th, 2024 the DUO prompt for Multi-Factor Authentication will be replaced with the DUO Universal prompt. All of the DUO functionality will remain available with one change: DUO push will be replaced with Verified DUO push. Instead of the usual push prompt, users will be presented with a 6-digit code (Image 1) that they will need to enter on their mobile device (Image 2).

Image 1

Image 2

As previously communicated, users whose mobile devices are not running the minimum required OS (version 10 for Android and version 14.5 for iOS) will get an error message when trying to use the Verified DUO push.

If you are using a device with an outdated version of the operating system to complete the authentication process, click on the “Other options” link displayed under the 6-digit code shown in Image 1.

This will reveal all of your registered devices with DUO and options available to complete the second factor of authentication (Image 3).

Image 3

The other options available are exactly the same as the ones you have with the DUO classic prompt used today. The phone call will continue to be available on all registered devices (mobile and landline).

Mobile devices will continue to have the option to receive a passcode via text message or through the DUO mobile app.

Please call the Service desk at 973-655-7971 or email itservicedesk@montclair.edu if you experience any issues using the DUO Universal prompt.

If you receive a similar email message, *do not respond* with any information. It is safe to just delete the message or you can report it as phishing via the Gmail web interface.

However, if you have provided any University information or account credentials, or have downloaded suspicious content, please contact your local academic technology team or the IT Service Desk at 973-655-7971, option 1, or by email at itservicedesk@montclair.edu to report the incident and be provided with additional guidance.

If you provided any financial or personally-identifiable information such as bank account or social security number that could potentially be used for identity theft, please contact University Police at (973) 655-5222 or msupolice@montclair.edu to file a report.

PLEASE NOTE: Montclair State’s Information Technology and other administrative and academic units will NEVER under any circumstances ask you to provide your password, social security number, protected health information, or other personal information via email. ANY email you receive asking for such information, regardless of the alleged source, should be considered fraudulent and deleted immediately.

We thank you for your continued diligence in recognizing and avoiding phishing scams. For additional information about identifying and protecting yourself against phishing scams please visit the IT web site at:

/information-technology/security/phishing/