Email scams

Look out for these warning signs to help identify an email scam:

• the email is unexpected or not personalised 
• you're told you need to do something urgently
• the email is worded strangely with poor spelling and grammar
• when hovering over links in the email, you notice unusual URLs (see use secure websites for more information) 
• the email has been sent from an unusual address or includes unusual 'Reply-To' addresses
• you're asked to enter personal information, open an attachment or link, or download a file
• you're repeatedly sent email requests to authorise access to an account which has multi-factor authentication (MFA) set up. 

At UQ, we use robust security systems to detect and block suspicious emails. However, some unwanted emails still make it past our filters.

To prevent email scams from being sent to your UQ email account: 

• don’t share your email address online unless you need to
• don’t provide your UQ email for personal activities, such as online shopping
• make sure you use your UQ email – rather than your personal email – for UQ work or study-related activities
• delete spam messages without opening them
• don’t respond to or unsubscribe from suspicious emails – scammers may use this to verify your email address
• follow the instructions to block suspicious email addresses in Outlook or Office 365.

If you receive a suspicious email in your UQ email account, don’t open any links or attachments or enter any personal or account information. Follow the instructions below to report the email through your version of Outlook.

If you have already opened an attachment, clicked on a link, downloaded a file or entered personal or account information, you should report it to the UQ Cyber Security Operations Centre immediately.

If you receive a suspicious message to your personal email address or phone number, do not open any links or attachments and report the details through Scamwatch's Report a Scam. This will allow the Australian Competition and Consumer Commission to stay aware of emerging online scams and concerns.

Outlook 365, 2019 and 2016

For staff

1. Select the email.
2. Select the 'Phish Alert Report' button on the top right of the screen.
   
   
    
3. Complete the fields shown (optional).
4. Click 'Phish Alert'.

For students

1. Select the email.
2. Click the down arrow next to the 'Report' button.
3. Click 'Report phishing' or 'Report junk'.
   
   
    
4. Click 'OK'.

The email will be deleted automatically from your inbox and reported to the UQ Cyber Security Operations Centre.

If you can't see a button:

1. Select the email. 
2. From the top 'Home' menu in the 'Respond' section, click 'More', then select 'Forward as Attachment'. Make sure you select 'Forward as Attachment' instead of 'Forward'
   
   
    
3. In the 'To' field, enter suspicious-emails@uq.edu.au
4. In the 'Subject' field, enter Suspected phishing email
5. Select 'Send'
6. Delete the original email.

Outlook for Mac

For staff

1. Select the email.
2. Click the elipsis (3 dots) on the top right of the window.
3. Select 'Phish Alert'.
   
   
    
4. Complete the fields shown (optional).
5. Click 'Phish Alert'.

For students

1. Select the email.
2. Click the down arrow next to the 'Report' button.
3. Click 'Report phishing' or 'Report junk'. 
   
   
    
4. Click 'OK'.

The email will be deleted automatically from your inbox and reported to the UQ Cyber Security Operations Centre.

If you can't see a button:

1. Select the email. 
2. Select the 'Message' toolbar menu on the top of the screen
3. Select 'Forward as Attachment'. Make sure you select 'Forward as Attachment' instead of 'Forward'
   
   
    
4. In the 'To' field, enter suspicious-emails@uq.edu.au
5. In the 'Subject' field, enter Suspected phishing email
6. Select 'Send'
7. Delete the original email.

Outlook Web App

For staff

1. Select the email
2. Click the 'Phish Alert' button within the email
   
   
   
   If you can't see the 'Phish Alert' button, click the 'Apps' button, then select 'Phish Alert'.
   
   
    
3. Complete the fields shown (optional)
4. Click 'Phish Alert'.

For students

1. Select the email.
2. Click the down arrow next to the 'Report' button.
3. Select 'Report phishing' or 'Report junk'.
   
   

The email will be deleted automatically from your inbox and reported to the UQ Cyber Security Operations Centre.

If you can't see a button:

1. Select 'New' from the top menu
2. Hover over the phishing email in your inbox and drag it into the new email
3. In the 'To' field, enter suspicious-emails@uq.edu.au
4. In the 'Subject' field, enter Suspected phishing email
5. Select 'Send' 
6. Delete the original email.

The above buttons are only supported in Outlook. If you use a different email client, you will need to continue to manually forward the email as an attachment to the UQ Cyber Security Operations Centre.

If you receive a suspicious email that is unrelated to UQ, submit the details through Report a scam.

Most email scams try to lure you into:

• clicking a link
• opening an attachment
• downloading a file
• entering account information.

If you do any of these things, the scammer can steal sensitive or confidential information, and your computer and UQ's systems can be compromised.

There are two main threats in email scams:

• phishing
• malware

Phishing

Phishing is a form of fraud used by scammers to steal your personal, work or UQ information.

Phishing emails are designed to look like legitimate emails from reputable organisations and people you trust. They may appear to be from another university, your bank, a government department, someone you know or even UQ. Scammers often copy the design, branding and logo of the organisation they claim to be from.

Phishing emails try to get you to click a link, open an attachment, download a file or enter your account information, so they can steal your data or infect your computer with malware.

Malware

Malware is used by scammers to infect your computer with malicious software.

There are many different types of malware, but they are all designed to damage or seize control of your computer. The goal is to steal your data or UQ's data.

If you open an attachment or link, or download a file from a fake email or website, you might infect your computer with malware.

Test your knowledge and see if you know how to spot a phishing scam by taking this quiz.