Phishing is among the top security concerns for Information Technology. Personal identifiable information, the primary target of phishing attempts, falling into the wrong hands can cause both financial and reputation damage to our university, students and its employees. Phishing attacks are often launched by including malicious attachments or links in email. When recipients open these malicious attachments or click on the links, it can spark an attack. Most email scams begin with messages from an external email system.

As part of Widener University’s effort to reduce phishing and other email scams and spoofing, these external email messages will now receive an [External:] tag in the message subject. [External:] email tagging makes it as easy as possible for you to recognize phishing attempts wherever you can.

Avoid being scammed

The best defense to avoid being scammed is to be suspicious of any message asking for sensitive information. If the message seems off, it probably is. Trust your instincts. Phishing attempts can be clever, but they’re easy to avoid if you know the signs.

What is [External:] tagging and how does it work?

Most email scams begin with messages from a non-Widener (external) email system. When tagging is enabled these external email messages will now receive an [EXTERNAL:] tag in the message subject. Many safe and legitimate email messages come from external email systems. The [EXTERNAL:] tag does not mean the message is a scam or malicious, only that recipients should take caution and read carefully. All email originating from outside the university, except for approved services, will be tagged with this [EXTERNAL:] message. See sample below:

What should I do when I see an [External:] email?

Its important to note that an email message with this warning does not necessarily mean the email is malicious, only that the recipient should take caution before clicking any links or attachments included within the email. The [EXTERNAL:] tag means you need to stop and think about this email:

• Is it from a sender you know?
• Were you expecting the email?
• Verify with your friend or co-worker over the phone if you are unsure or if the email seems a bit off.
• If there is a link in the message, Don’t click it! Instead, hover over the link to verify it is legitimate, or manually enter the known good URL into your browser.
• Does the message make sense?
• If you are concerned and unsure, send the message to Phish@widener.edu

Note: A legitimate message would not ask you to provide your credentials to maintain your account access.