Phishing Scams

How to spot a phishing scam and what to do

Phishing scams often have clear signs. When you receive any email or text message, look out for the following things.

• Too-good-to-be-true offers. For example, a phishing scam could offer a very expensive item for a bargain price. Remember, if it looks too good to be true, it probably is. 
• Suspicious senders that “don’t look quite right”. Be on the lookout for email addresses that are external to the University, slightly different from the official one or contain strange characters. The sender could be attempting to impersonate a trusted service or person that you know, like a Lecturer.
• Suspicious links or attachments. For example, an invoice when you haven’t bought a product or service, or an unexpected document that has been "shared with you" via SharePoint or OneDrive.
• Spelling or grammatical errors. This is a deliberate tactic phishing scams use to:
  • Bypass spam filters that look for specific keywords
  • Mimic casual speech to seem more realistic
  • Deliberately filter for targets who may be more susceptible to scams
• Pressure, threats, or urgency. Scammers use this tactic to make you panic and be more likely to engage with the scam.
• Requests for personal information or passwords.

Phishing scams can often be very convincing, which is why you need to read every communication carefully and carry out these steps:

1. Look for external tags: Emails from outside the University may be marked as external, treat these with extra caution. 
2. Check the sender: Look closely at the email address, not just the display name. Scammers often disguise this to appear legitimate. Hover over or right‑click the sender’s name to see the real address. 
3. Verify the message: If you’re unsure, contact the person or organisation directly using a trusted, separate contact method (such as Microsoft Teams) or official contact details. Don’t use the information provided in the message.
4. Check the greeting: Phishing emails often use generic greetings such as "Dear customer" or "Dear student".
5. Trust your instincts: If in doubt, report it. It’s always better to be safe. 

Every time you receive a phishing email – even if you don’t click on a suspicious link - remember:

• Always report phishing emails – don’t ignore them. You can learn how to report suspicious emails below.
• Don’t click any links, open attachments or approve unexpected sign in requests.
• Don’t forward the email.
• Don’t reply to the email.

Reporting a phishing scam

Reporting is quick, simple, and the safest way to deal with anything suspicious. Reporting a phishing email does more than remove it from your inbox: it strengthens our security and keeps everyone safe. When you report a suspicious message, it will:

• Remove the email from your inbox to protect your account and data.
• Stop any harmful malware spreading to others in our community.
• Help block similar threats in the future by improving our filters.
• Notify the University’s Information Security Team so they can investigate the email and take further action if needed.

How to report a phishing email

• There are different ways to do this dependent on what device and email client you’re using, as well as whether you’re using an app or checking emails in your browser.
• Most email clients like Gmail, Yahoo and Outlook have a ‘report’ button when you are viewing an email, and many will give you the option to report an email specifically as phishing.
• Report buttons can generally be found in multiple places: the toolbar when viewing an email, by right-clicking an email in your inbox, or by using a drop-down menu when viewing an email.

Our Digital IT team have put together a guide to how to report from different email clients. View how to report a phishing email on our Service Portal.

There are a few ways to report a phishing email in Outlook: