New website can help you identify authentic campus email messages

The next time you receive a UC or UC Davis e-mail message that looks authentic--but asks you for information that could be a clever phishing attempt--you can check a new campus website to help you decide if the message is legitimate.

The site, security.ucdavis.edu/authentic.html, is maintained by the IT Express Computing Services Help Desk. IT Express will post messages to the site only if it knows the message is authentic.

Phishing scams try to trick you into disclosing personal information. They usually try to look genuine, but contain red flags. The scams typically ask for your password or login name, urge you to act quickly, seem threatening, or use poor grammar or misspelled words. They might ask you to "confirm" your account information, or "alert" you to unexpected activity on a bank account.

However, some legitimate messages sent to multiple recipients cannot avoid using elements that resemble phishing. For example, the Sept. 11 University of California email message to employees, telling them how to complete the university's mandatory compliance briefing, sends recipients to a website they might not recognize. It also requires compliance. Those qualities would have made the UC message a good candidate for the new registry, if it had existed then.

The registry does not list all authentic campus mass messages. To be listed, a message must:

• Be current.
• Be sent to IT Express, usually from the message\031's sender or via the campus bulk-mail process.
• Contain enough elements that could be construed as phishing.

How to use it

The page includes instructions on how to suggest a mass message, either your own or someone else\031's, for the registry.

To suggest a message that has been or will be sent to multiple addresses, send an exact copy to ithelp@ucdavis.e du. IT Express will evaluate and post the message if appropriate. It will not post a message unless the author agrees, nor will it post a message before it is distributed. Messages will remain on the registry for about, but not less than, 30 days.

The registry posts the message's subject line, who sent it, and when it was sent. Clicking on the entry brings up a copy of the entire message.

Also, all messages distributed through the bulk-email process managed by Information and Educational Technology (IET) will automatically be evaluated for listing on the registry.

"We have had several requests for this service, especially from the campus technology community," said campus Information Technology Security Coordinator Robert Ono. "We offer it as one more tool that people can use to keep their personal accounts and information safe."

"We ask people to avoid sending bulk messages that contain phishing characteristics, if possible," he said. "Sometimes you can rewrite a message to make it less suspicious. If you cannot do that, please use the registry."

The best defense

The page will not list phishing scams. The volume is so large and unending that the campus could not possibly keep up.

Nor will the page list UC or UC Davis messages that do not resemble phishing. Listing plainly safe messages could confuse people as to what phishing is.

"The best defense against phishing is to know how to spot it. This registry just points out those few messages from campus sources that resemble phishing, but are legitimate," Ono said. "We hope people will take this opportunity to learn more about phishing."

The IET security team and IT Express will re-evaluate the new registry in early 2013, to assess how people are using it and make revisions if needed. Please send any comm ents or questions to Ono through security@ucdavis.edu.

Faculty, students or staff who have doubts about any message, regardless of whether they want to suggest it for the new registry, can always contact IT Express at (530) 754-HELP (4357).