![\"Fake](\"https:\/\/www.montclair.edu\/phish-files\/wp-content\/uploads\/sites\/290\/2026\/03\/fake-login-page.png\")
<\/h2>\n<\/h2>\nAttackers often copy familiar language and formatting to make their messages look official. In this case, the email:<\/p>\n
Impersonates the IT department<\/strong> by using \u201cIT Service Desk\u201d as the sender name and in the signature.<\/p>\n<\/li>\n References email security changes<\/strong>, which can sound like a normal IT update.<\/p>\n<\/li>\n Targets all university employees<\/strong>, creating the impression of a campus-wide requirement.<\/p>\n<\/li>\n Includes a call-to-action link labeled \u201cBegin,\u201d<\/strong> prompting users to take immediate action.<\/p>\n<\/li>\n<\/ul>\n There are several red flags that reveal this message is not legitimate:<\/p>\n The email comes from an external address<\/strong>, not an official Montclair account.<\/p>\n<\/li>\n The sender name was changed to appear as the IT department<\/strong>, even though the underlying email address is not from the university.<\/p>\n<\/li>\n The message directs users to a login page through an embedded link<\/strong>, which is a common tactic used to capture credentials.<\/p>\n<\/li>\n The wording is vague and urgent<\/strong>, lacking the details typically included in official IT communications.<\/p>\n<\/li>\n<\/ul>\n Legitimate IT updates will never ask you to verify your password through an unexpected external link.<\/p>\n If users interact with the link in the email, they are taken to a fake login page designed to look like the university\u2019s sign-in page<\/strong>.<\/p>\n If credentials are entered on this page, attackers can capture them and potentially:<\/p>\n Access the user\u2019s Montclair email account<\/p>\n<\/li>\n Send phishing messages from the compromised account<\/p>\n<\/li>\n Access sensitive communications or files<\/p>\n<\/li>\n Attempt to gain access to other university systems<\/p>\n<\/li>\n<\/ul>\n Compromised accounts are often used to continue phishing others across campus.<\/p>\n If you receive this email:<\/p>\n Do not click the link or reply to the message.<\/strong><\/p>\n<\/li>\n Report the email using the Phish Alert Button<\/a>.<\/strong><\/p>\n<\/li>\n<\/ul>\n If you already clicked the link or entered your credentials:<\/p>\n Change your password<\/a> immediately.<\/strong><\/p>\n<\/li>\n<\/ul>\n How It Looks Legitimate Attackers often copy familiar language and formatting to make their messages look official. In this case, the email: Impersonates the IT department by using \u201cIT Service Desk\u201d as the sender name and in the signature. References email security changes, which can sound like a normal IT update. Targets all university employees, […]<\/p>\n","protected":false},"author":349,"featured_media":1500,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[3],"tags":[],"class_list":["post-1499","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-phishing"],"_links":{"self":[{"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/posts\/1499","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/users\/349"}],"replies":[{"embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/comments?post=1499"}],"version-history":[{"count":3,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/posts\/1499\/revisions"}],"predecessor-version":[{"id":1504,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/posts\/1499\/revisions\/1504"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/media\/1500"}],"wp:attachment":[{"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/media?parent=1499"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/categories?post=1499"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/tags?post=1499"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}How We Know It\u2019s a Phish<\/h2>\n
\n
What Happens If You Click the Link<\/h2>\n
\n
What To Do<\/h2>\n
\n
\n
Additional Notes:<\/h2>\n
\n