Ohio State regularly runs phishing training exercises to the university community. By clicking the link that brought you to this page, you succumbed to a university phishing simulation. Read on to learn how to spot phishing messages and protect yourself and the university from malicious attacks.
Spotting the Phish
You received this email:
Sender Addresses: The sender address, apple@paypol-login.com, is not a legitimate domain for the PayPal service and should raise red flags. The domain (everything after the @ symbol) is the first indication that this might be a phishing attack.
Suspicious Language: The email is threatening recipients about the potential of being charged for a product they did not order. There are grammatical errors and one should be careful to inspect emails before acting.
When you click View Receipt Here, you are sent to a fake log in page.
Review the URL of web page before engaging with it: When you clicked from the email, a website was loaded with a URL of https://order-history.paypol-login.com, which is not a legitimate site. Attempt to confirm the legitimacy of a site before you enter login credentials or personal information like name, email address or phone number.
Report Phishing Attempts
If you ever suspect an email to be a phishing attempt, please report it immediately by clicking the "Report Suspicious" button in the warning banner which appears at the top of that external email.