Email - Handling and Reporting Suspicious Mail

Junk Phishing

If you have clicked on a suspicious link, please call the KU IT Customer Service Center at 785-864-8080 and report the message as phishing as outlined below.

Phishing is an attempt to steal personal information or break in to online accounts using deceptive emails, messages, ads, or sites that look similar to sites you already use. For example, a phishing email might look like it's from KU and request private information about your KU account.

When reporting a message as "Phishing" the senders email address is not blocked automatically.

Junk emails, also known as spam, are unwanted, unsolicited messages sent in bulk to a large group of recipients. They are usually sent for commercial purposes, and can be a threat to the recipient.

When reporting a message as "Junk" you may be asked if you want to block the sender.

Examples: Phishing Email

Phishing is not just limited to emails but also includes websites & text messaging. If you receive an email from an unknown source or something you was not expecting. You should always remain cautious. These types of communications have some distinct characteristics:

Drive a sense of urgency.
Offer something that is too good to be true.
Impersonate VIPs at KU.

They do this to gain unauthorized access to KU resources. There are some things users can pay attention to that will help identify suspicious communications such as:

Spelling & Grammatical Errors.
Suspicious URL's.
- Impersonate KU & Microsoft Website(s).
Suspicious Attachments.
Data simply does not align with what is expected.
- IE - Phone number from out of state impersonating the help desk.

Here are some examples of attempts to gain unauthorized access to KU resources.

Phish #1
- Incorrect use of punctuation.
- Suspicious Attachment.
Phish #2
- Impersonates Microsoft - From address is not Microsoft Related.
- Drives a sense of urgency over the prospect of one losing access to something.
Phish #3
- Looks like a Microsoft site with all of the images, the url is not Microsoft.
Phish #4
- Impersonation of Provost.
- Driving a sense of urgency.
Phish #5
- This occurred after someone at KU gave up their credentials to threat actors.
- Once you've given away your personal details, you are on your own in regards to blocking future communications by phone number on your cellar device. KU IT can not assist with this.

How to report Suspicious Message

The following instructions only apply to Outlook. If you are using an email client such as Thunderbird or another third party client, please forward the suspicious email to abuse@ku.edu.

Android

Open the suspicious email (to view it only) and tap the three dots in the top right.
Tap Report Junk from the menu.
Select one of the options provided based upon the type of email.
- Junk Emails: Typically these are marketing or sales driven types of emails.
- Phishing Emails: These emails attempt to gain unauthorized access by driving a sense of urgency.
Tap Report.
- Check the remember my decision, this is optional.

iOS

Open the suspicious email (to view it only) and tap the three dots in the top right.
Tap Report Junk.
Tap one of the options provided based on the type of email.
- Junk Emails: Typically these are marketing or sales driven types of emails.
- Phishing Emails: These emails attempt to gain unauthorized access by driving a sense of urgency.
Tap Report.

Mac

Click the suspicious email (to view it only) and click the Report button at the top.
Click one of the options provided based on the type of email.
- Junk Emails: Typically these are marketing or sales driven types of emails.
- Phishing Emails: These emails attempt to gain unauthorized access by driving a sense of urgency.
- Check Don't ask again, this is optional.
Click OK.

Web App (OWA)

Click the suspicious email (to view it only) and click the Report button at the top.
Click one of the options provided based on the type of email.
- Junk Emails: Typically these are marketing or sales driven types of emails.
- Phishing Emails: These emails attempt to gain unauthorized access by driving a sense of urgency.
Click Report. The email is reported to Microsoft for analysis.
- Check the Don't show me this message again, this is optional.

Windows

Click the suspicious email (to view it only) and click the Report button at the top.
- To the right is a button with a drop-down that says Report Message.
Click one of the options provided based on the type of email.
- Junk Emails: Typically these are marketing or sales driven types of emails.
- Phishing Emails: These emails attempt to gain unauthorized access by driving a sense of urgency.
Click Report and now the email has been reported to Microsoft for analysis.
- Check the Don't show me this message again, this is optional.

Add, Remove, Edit Blocked Senders

You can manage your block list by following these instructions. You can not access the block list on mobile devices.

Outlook - Mac

Click on the Tools menu option.
Click on Junk Email Preferences.
You can only add / remove blocked senders:
Add Blocked Sender: Type the email address or domain into the highlighted segment shown block. Click + when finished.
name@domain.com - blocks only that email.
@domain.com - blocks the entire domain.

Remove: Use the search box to find the entry that needs to be removed. Click - to remove the entry.

Outlook - (OWA)

Click on the Gear icon in the top right corner of the screen.
Click Junk Email.
Click Blocked senders and domains.
Add Blocked Sender: Allows you to add an email address.
name@domain.com - blocks only that email.
@domain.com - blocks the entire domain.
Edit: Use the search list to find entry.
Click the Pencil to make edits.
Click the Trash Can to delete the entry.

Outlook - Windows

On the Home tab. Click the Block button.
Click Junk Email Options.
Click on Blocked Senders.
- Add: Allows you to add an email address.
  name@domain.com - blocks only that email.
  @domain.com - blocks the entire domain.
- Edit: Must click on a blocked address first.
  Allows you to edit a blocked address that already exists.
- Remove: Must click on a blocked address first.
  Allow you to remove a blocked address so you can receive email again.