Week 3: Login Webpage Phishing Poster 1
Week 3: Login Webpage Phishing Poster 1 Heading link
For the first two weeks of National Cyber Security Awareness Month, we focused on phishing email messages and the links they contained to phishing login webpages. This week we’re taking a closer look at phishing login webpages.
Common Red Flags to look for to determine if a login webpage is real include:
1. Check for the padlock and that the URL starts with https://
That “s” stands for “Security”, and indicates that whatever information you enter in the webpage is being securely transmitted. This is critical for login pages, e-commerce websites, and bank or credit card websites to ensure that the information you send cannot be viewed while going across the network. If the webpage address doesn’t start with https:// back away and send details of the website to security@uic.edu.
2. Verify that the webpage address is in the uic.edu, uillinois.edu, or illinois.edu domain
Bad actors will try to trick you by adding uic.edu in the middle of the webpage address, but uic.edu should be between https:// and the next / (slash). For example https://accountportal.uic.edu/ is a real UIC webpage, but http://university-system.org/uic.edu/login.html is a fake webpage address.
3. Check that the login screen is not asking for additional or repetitive information
Fake login pages sometimes ask you to supply information about yourself, in addition to your Netid and password, that can be used to circumvent security protections in place and steal your identity. Some information they may ask for that a legitimate login page would not ask for include your NESSIE PIN, Date of Birth, and Social Security Number. Other fake login webpages might ask for you to enter your email address in one box, and then confirm your email address in another box. This is the attacker’s way of trying to ensure they have the correct information to compromise your account!