What is Phishing?
Phishing is when internet scammers try to trick you into giving away your private information.
Unexpected phone calls, text messages, and emails could all be phishing. Anyone can fall victim to a phishing scam. The best way to protect yourself is to learn to identify scams when you see them. Always treat unexpected messages as suspicious until you verify the sender is who they say they are.
What does a scam look like?
Click a category title to learn more about that topic
A fake job or internship offer that looks real but is meant to steal your money or personal information. These often show up on job boards, social media, or in your email out of nowhere.
Scammers post attractive listings, easy pay, flexible hours, remote work — to trick students who want to gain work experience. They might ask you to pay for “training” or equipment before you start the “job,” or send you a fake check and ask you to send part of the money back. If a job seems too easy or too good to be true, it probably is.
A message claiming you’ve won a prize, gift card, or contest you never entered. It usually asks you to click a link or share personal information to “claim” your reward.
These scams create excitement and urgency to get you to act before you think it through. You might be asked to enter your email, phone number, or even payment info to cover “shipping” for a prize that doesn’t exist. Real giveaways don’t require you to pay anything or hand over sensitive details to receive them.
Financial scams try to trick you into sending money or sharing banking information. Scammers may pretend to be an organization, bank, or job provider who will provide you financial aid for college expenses.
Scammers will promise grant funds that are too good to be true. They can send fraudulent checks that temporarily clear, and usually demand some repayment before the check balance is reversed. They may also demand sensitive personal information such as your bank account or social security number.
Always go through verified channels with the Financial Aid department at Delaware Tech.
A type of email scam that targets a specific person. It uses real information about that person to make the message seem trustworthy. Unlike regular email scams that are sent to many people, spear phishing messages are meant just for you.
The sender might mention your school, a class you’re taking, a club you’re in, or the name of a friend. The scammer will often find this information on social media or from data breaches. Because a spear phishing message is made to feel personal to you, it can be harder to recognize as a scam than a typical fake email.
Credential Harvesting is a scam that tries to trick you into entering your username and password on a fake website. The page is designed to look like a real login screen, like your school portal or email account.
You may get to the fake page by clicking a link in an email. The email might say that there is a problem with your account, or that you need to verify your information. When you enter your username and password into the fake page, the scammer can then steal that information. Always check the website address in your browser before you log in. If the web address doesn’t exactly match the real site, do not enter your password.
A file attached to an email that puts harmful software on your computer, phone, tablet, or other device when you open it. The attachment might have been made to look like an assignment, a resume, or a document someone “shared” with you.
These attachments can secretly install viruses, spyware, or programs that allow a scammer access your files or track what you type. They often come with urgent messages like “review this immediately” to get you to open the file without thinking. Never open an attachment from someone you don’t know and be cautious even with unexpected files from people you do.
An email or message where the sender pretends to be someone you trust, like a teacher, coach, or school administrator. They use that trust to ask for money, gift cards, or personal information.
A common version of one of these emails involves a scammer posing as a principal or teacher, claiming they need a favor done quickly and quietly, like buying gift cards for a “surprise.” The request usually stresses urgency and secrecy to stop you from checking with the real person. If a request seems unusual, contact the person directly through a phone number or method you already know is real.
Three versions of the same trick delivered through different channels: smishing happens over text message, vishing happens over a phone call, and quishing happens through a QR code.
The names of these tricks refer to the method of communication they use. Smishing messages are fraudulent SMS messages. Vishing is fraudulent voice calls, and quishing describes malicious QR codes, which can be dangerous to scan.
Tips to avoid being phished
Click a category title to learn more about that topic
Pause before clicking any link or button in an email or text, even if it looks familiar. A few seconds of hesitation can stop a scam before it starts.
Scammers count on people acting fast without reading closely. Before you click, ask yourself if you were expecting this message and if the request makes sense. If anything feels off, it’s safer to go directly to the website or app yourself instead of clicking the link provided.
Be careful about sharing things like your password, birthday, address, or student ID number, especially if someone asks for it out of nowhere. Legitimate organizations rarely ask for sensitive information over email or text.
Scammers use small pieces of personal information to build a more convincing scam or to access your accounts directly. Even details that seem harmless, like your school schedule or a family member’s name, can be used against you. When in doubt, don’t share it until you’ve confirmed who’s actually asking.
Scammers create a sense of urgency to get you to act before you have time to think it through. Real emergencies from real organizations rarely depend on you clicking a link in the next five minutes.
Phrases like “your account will be suspended” or “respond immediately” are designed to trigger panic instead of careful thinking. Slowing down and taking a moment to verify the request is one of the simplest ways to avoid falling for a scam. If a message is pressuring you to rush, treat that pressure itself as a warning sign.
Software updates help fix security problems that hackers can use to get into your devices. Keeping your phone, laptop, and apps up to date helps protect your information and keeps your devices safer.
Updates aren’t just adding new features — many updates fix security issues that are found after the software is released. Turn on automatic updates so you can stay protected without having to think about it. If you skip updates for too long, your device may be easier for hackers to target.
Before you trust an email, check the sender’s email address, not just the name you see. Before clicking a link, move your mouse over it, or press and hold it on a mobile device, to see where it really goes.
Scammers often use email addresses and links that look very similar to the real ones, with just one letter or number changed. The name shown in an email can be fake, so always double check the actual email address. If something looks different or suspicious, don’t click the link or reply to the message.
A strong password is long, hard to guess, and different for every account you have. Reusing the same password everywhere means one leaked account can put all your other accounts at risk.
A password manager can generate and remember complex passwords for you, so you don’t have to. Avoid using obvious information like your name, birthday, or “password123.” The stronger and more unique your passwords are, the harder it is for a scammer to break in. Get more information on how to create a strong password.
Note: Do not share your password with anyone; a Delaware Tech employee will never ask for your password
Multi-Factor Authentication (MFA) adds a second step to logging in. This second step is some form of private code that you will need to enter in addition to your password when you log into your account. This code can come in the form of a text message, email, notification, or phone call. Even if a scammer steals your password, MFA can stop them from getting into your account. MFA is required for all Delaware Tech accounts.
Most major platforms, including school accounts, email, and social media, offer MFA as a free security setting. It only takes a few extra seconds when you log in, but it makes your accounts significantly harder to break into. Using MFA is one of the single most effective things you can do to protect yourself. Get more information on how to set up MFA for your Delaware Tech account.
Note: Do not share your MFA information with anyone; a Delaware Tech employee will never ask for your MFA code
If you get a suspicious email or message, report it to your school’s IT department or use the “report phishing” option instead of just deleting it. Reporting helps protect others who might receive the same scam.
Many scams target an entire school or organization at once, not just one person. Reporting gives IT staff a chance to warn others and block the sender before more people are affected. If you’re ever unsure whether something is a scam, it’s always better to ask than to guess. Get more information on how to report a message as phishing.
What if I think I have been scammed?
- Call the IT Help Desk at (302) 857-1700 or visit the IT Virtual Support Center. Tell the IT technician that you fell for a scam then ask the technician to reset your password and to review your multi-factor authentication (MFA) methods
- Forward any fake emails or text messages to cyber-security@dtcc.edu and report as phishing in Outlook
- If you gave the scammer any other personal information and/or made payments, please contact public safety for your campus and/or local law enforcement
- Reset the passwords for any affected online accounts. Change the password for your personal email accounts first, then your banking accounts, then other important websites afterward. Avoid reusing the same passwords for multiple accounts
You can help!
We recommend reporting any phishing emails to our cyber security team by forwarding them to cyber-security@dtcc.edu before you do anything else – this helps other users to be protected from falling for the same scam.
Next, you can help Microsoft learn to filter these phishing emails by using Outlook’s “report message” feature:
- Desktop app: Open the message in its own window; the report button is at the top right
- Web: Open the message; the report option is across the top to the right of the “New Email” button. Select “Phishing” from the menu that appears
- iPhone / Android: Open the message, tap the three-dot menu at the top right, and choose the “report” option
Please note that once you report the phishing email to Microsoft, it will automatically delete the message.