Q: What is a phishing email?

On this page:

Answer

Phishing is the fraudulent practice of sending emails pretending to be from reputable sources in order to steal passwords or sensitive personal or financial information, or to install malware on the target’s computer.

It’s common for attackers to make it seem like the message is coming from the IT department of your school or employer, your manager, friends, or companies that you do business with. These emails are successful because they manipulate our sense of urgency, fear, curiosity, greed, and desire to please.

Things to watch out for:

• Are you being asked to urgently do something? (log in to verify an account, retrieve messages, call IT support)
• Are you being asked to do something you don't normally do? (buy giftcards, change bank account numbers)
• Does this involve a password, money, or opening an attachment?

You can help us protect others at the Institute: If you receive a phishing email please report it (using the Phish Alert Button or forward it as an attachment) to phishing@mit.edu. If you receive an email you aren't sure about, please don't hesitate to ask. If you report using the Phish Alert Button, please leave a comment with your question. If not, please forward the email as an attachment to security@mit.edu and include your question.

Phishing examples

Recent phishing emails targeted at MIT are often shared on the MIT Phish Bowl. Also see Common Email Scams for examples and explanation of scams we often see over email.

If you've fallen for a Phishing scam

If you think you've fallen for a phishing scam please follow these steps to recover. It's important to change your password ASAP if it is compromised.

See also

• Reporting Phishing Email
• MIT Information Protection