There has been a recent increase in email phishing scams that are impersonating U-M leaders and asking for gift cards to be purchased. Please don't fall for it! Even if the email comes from your chair, dean, or director. Review and follow the below guidelines that detail the best way to report phishing emails, how to verify legitimacy, and awareness of current activities.
Recognize Phishing Attempts: Scammers continue to target faculty and staff with emails that appear to be from their unit or other U-M leadership asking for help with a payment or gifts for an event, and a promise of reimbursement. They may even impersonate organizations outside of the university, such as the IRS, to trick people into sending money or personal information.
Here's what you can do:
Be suspicious of communications with urgent, unfamiliar requests. Review the sending email address closely to see whether it is a U-M address. Check with the apparent sender by phone call, chat, or in-person if you are at all unsure. Or send a separate email to the person's usual email address. Do not reply to the request itself.
Ignore requests for payment via gift card. "Anyone who demands payment by gift card is always, always, always a scammer," according to the Federal Trade Commission (FTC). "Gift cards are for gifts, not payments."
Verify unusual requests for money (via wire transfer, gift card, or other means), including those from your supervisor or leadership, before acting.
Do not open unexpected attachments, shared documents, or click on the links. Scammers frequently send emails that appear to be from someone you know to trick you into an action that will lead to infecting your computer. They also use phishing emails to disguise malicious software as shared documents, attachments, or university links that will corrupt your files.
Check U-M phishing alerts. Samples of phishing and other scam emails reported at U-M are published at Safe Computing: Phishing Alerts. This is not a complete or comprehensive list of emails received, but it can give you an idea of what common malicious emails look like.
Report emails impersonating people at U-M by sending them to [email protected]. Include full message headers if possible.
Report compromise. If you suspect you fell for a scam or your account was compromised, change your password—your UMICH (Level-1) and/or your Michigan Medicine (Level-2) password. Then report it: Report an IT Security Incident.
