Employee Engagement Feedback

Why this looks valid

  • The message appears to be from Vassar College.
  • The explanation in the email seems legitimate and is purportedly from the Vassar College president.

Why this is phishing

  • The link that launches from the email does not go to a Vassar site or any other service related to Vassar.
  • The originating email address is not from an internal Vassar account.
  • After taking the survey, the website asked for a password through a login screen that is not similar to any Vassar College service.
  • Any survey sent from HR or the President’s Office is preceded by an announcement email that clearly states where the survey is from and when it will be received; in this case no such initial email was sent.

Additional notes

  • This is an extremely dangerous Phishing attempt. If you clicked on this link and submitted your password, please contact the Service Desk immediately at x7224 or servicedesk@vassar.edu
  • Always examine the link! Look at the information in your web browser to determine whether or not the site you are directed to is a Vassar site or an unknown (or suspicious) one.
  • A phone call to the alleged sender would quickly verify if this is a legitimate email. It only takes a few minutes to pick up the phone!
  • Report it as phishing to Google. Before deleting the message, make sure to click on “report phishing”.
  • A little paranoia goes a long way! Be suspicious of any email messages similar to this one.
  • Did you know: the best way to protect your accounts is by using multi-factor authentication. See our recent post here: http://pages.vassar.edu/catchoftheday/2017/06/29/best-practice-enabling-multi-factor-authentication-with-duo/