The university’s Information Assurance team is urging faculty and staff to be extra diligent as tax season draws near by being alert to “phishing scams” aimed at gaining access to personal information.
At this time of year, when employees nationwide are accessing their W-2 forms online, these scams are common, and it’s not unusual for U-M employees to be targeted in these types of scams, says Sol Bermann, the university’s interim chief information security officer.
more information
Once a scammer gains access to an employee’s personal information, that information can be used to access a W-2 form and file a false income tax return showing a tax refund. Already a small number of U-M employees have reported that their personal information has been compromised.
One of the best defenses against any phishing attack, says Bermann, is to implement two-factor authentication.
“The two-factor approach provides an additional layer of security to guard against these types of attacks, even if the attacker gets someone’s UMICH password,” Bermann says. He also encourages employees to report or delete any email that seems suspicious.
Bermann notes that these types of attacks occur across the nation and pop up every year around this time. Phishers are successful when individuals let their guard down. The Information Assurance team offers these tips for avoiding these types of scams:
• Look before logging in. When someone logs in on the web using the university’s web login page, they should check the URL before enter their password. Before entering a UMICH password on a web page, check that the page’s web address/URL begins with: https://weblogin.umich.edu/
• Turn on two-factor authentication to prevent criminals from getting into an account with a stolen password. This quick-and-easy process offers a second layer of security and can easily be tied to a cell phone or another device. Check for additional details about two-factor authentication.
• Report suspicious emails. People who are not sure if an email asking them to login is authentic should report it to the ITS Service Center ([email protected] or 734-764-4357) or delete it.
Those who think they have been victimized by a phishing scam should:
• Change their UMICH (Level-1) password immediately to stop the criminals from getting into their account. Learn more about choosing or changing a password.
• Report to the ITS Service Center or the Michigan Medicine Service Desk ([email protected] or 734-936-8000) any suspicions that their account has been compromised. This allows IT staff to check for signs of unauthorized logins or other criminal activity.
