{"id":411,"date":"2025-03-10T15:30:08","date_gmt":"2025-03-10T19:30:08","guid":{"rendered":"https:\/\/www.montclair.edu\/phish-files\/?p=411"},"modified":"2026-02-16T13:41:19","modified_gmt":"2026-02-16T18:41:19","slug":"411","status":"publish","type":"post","link":"https:\/\/www.montclair.edu\/phish-files\/2025\/03\/10\/411\/","title":{"rendered":"Your refund has been paid"},"content":{"rendered":"<h2><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.montclair.edu\/phish-files\/wp-content\/uploads\/sites\/290\/2025\/03\/Screenshot-2025-03-10-083616-809x1024.png\" alt=\"Screenshot of the landing page for the phishing email regarding refunds.\" width=\"654\" height=\"828\" \/><\/h2>\n<h2>Why this looks valid:<\/h2>\n<ul>\n<li>Email has the banner and wording of an email coming from MSU<\/li>\n<li>Link in email states it&#8217;s going to TouchNet<\/li>\n<\/ul>\n<h2>Why this is phishing?<\/h2>\n<ul>\n<li>The email addresses utilized are either from an external email address or from an MSU user that would not send this information<\/li>\n<li>Link goes to BankMobile not TouchNet<\/li>\n<\/ul>\n<h2>Additional Notes:<\/h2>\n<ul>\n<li>Do you think you&#8217;ve fallen for a scam? Did you share personal information? Downloaded malicious content? Please contact the IT Service Desk at <a href=\"tel:973-655-7971\">973-655-7971<\/a>\u00a0option 1 or email <a href=\"mailto:itservicedesk@montclair.edu\">itservicedesk@montclair.edu<\/a>.<\/li>\n<li>Please send any malicious emails you have received to <a href=\"mailto:phishfiles@montclair.edu\">phishfiles@montclair.edu<\/a> or by clicking the <a href=\"https:\/\/www.montclair.edu\/information-technology\/security\/pab\/\">Knowbe4 Phish Alert Button (PAB)<\/a>.<\/li>\n<li>Always use the &#8220;hover over&#8221; technique to check web links before clicking! For more security tips please visit our <a href=\"https:\/\/www.montclair.edu\/information-technology\/security\/security-tips\/\">Security Tips<\/a> page.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Why this looks valid: Email has the banner and wording of an email coming from MSU Link in email states it&#8217;s going to TouchNet Why this is phishing? The email addresses utilized are either from an external email address or from an MSU user that would not send this information Link goes to BankMobile not [&hellip;]<\/p>\n","protected":false},"author":349,"featured_media":412,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[8],"tags":[],"class_list":["post-411","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-spear-phishing"],"_links":{"self":[{"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/posts\/411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/users\/349"}],"replies":[{"embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/comments?post=411"}],"version-history":[{"count":5,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/posts\/411\/revisions"}],"predecessor-version":[{"id":1410,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/posts\/411\/revisions\/1410"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/media\/412"}],"wp:attachment":[{"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/media?parent=411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/categories?post=411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/tags?post=411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}