About Phishing

Phishing schemes are attempts to steal personal information through fraudulent email that looks legitimate. These email messages often provide links to fraudulent websites where you are asked to disclose credit card numbers, social security numbers, or other private information.

You should be aware that illegitimate email messages are sometimes sent to USC account holders with variations of the Subject line: Re-Activate Your Account. At first glance, these messages may appear to be USC email. However, the messages urge recipients to reply by email and include their USC password and other personal information. Always remember that neither USC nor ITS will ever request that you submit personal information, including any passwords, over email.

Click the image below to learn how to detect a phishing message from a legitimate email, or else download the PDF.

Although phishing is often easily recognizable due to poor grammar or bogus Reply-to addresses, some phishing attempts are relatively sophisticated. Always use caution when replying to unsolicited email. Follow the guidelines below to protect your personal and financial information:

• Be suspicious of email messages that contain urgent requests for personal financial information, even if they appear to be from a trusted source (PayPal, eBay, your bank, etc.).
• Do not click links in email messages that you suspect are not legitimate. Instead, open a new browser window and type in the URL directly.
• Do not disclose personal or financial data in email.
• Verify the security of the websites you visit by making sure that the web address begins with https: rather than http: before submitting credit card or other sensitive information online.
• Review your bank, credit, and debit card statements regularly to ensure that all transactions are legitimate.
• Keep your browser up to date and make sure to apply all released security patches.

Reporting Phishing

To report a possible phishing attempt to ITS security, forward the complete email, including all headers, to security@usc.edu. To report spam (or unwanted advertising), forward the email to missedspam@usc.edu.

Phishing attempts often direct users to websites that have been "pharmed." Pharming occurs when a hacker attacks a DNS server and changes its IP address, redirecting users from a legitimate website to a compromised version of the original site. If you become aware of a phishing scam, you may also consider filing a complaint with the FBI on the Internet Fraud Complaint Center of the FBI website or forwarding the email to the Federal Trade Commission and the company being spoofed (e.g., spoof@ebay.com).

When forwarding spoofed messages, always include the original email in its entirety, complete with the original header information. Do not modify any of the information in the original email.

Getting Help

For more information on how to avoid phishing and pharming scams, please visit the website of the Anti-Phishing Organization.

For other questions, please contact the Customer Support Center at 213-740-5555 or send an email to consult@usc.edu.