Think Before You Click: Phishing in the age of AI

Phishing emails are becoming more convincing.

AI allows criminals to create messages that are better written, more personalized and more difficult to spot than the phishing emails many of us learned to recognize years ago.

Typos, awkward grammar and obvious formatting problems are no longer reliable warning signs.

Instead, look for other indicators:

• Unexpected requests for information or payments
• Messages creating urgency or pressure
• Links that don't match the organization they claim to represent
• Requests to sign in to unfamiliar websites
• Emails that seem unusual, even when they appear to come from a trusted source

When in doubt, report it.

Reporting suspicious messages helps Information Technology Services identify threats more quickly and protect the broader Western community. The easiest way to do that is by using the Report button in Outlook.

To help faculty and staff become familiar with this process, ITS will conduct a campus-wide phishing fire drill later this month.

Unlike a traditional phishing simulation, this message will clearly identify itself as a phishing exercise. Recipients will be asked to use Outlook's Report feature to report the email. The goal is simple: provide hands-on practice before a real phishing attempt arrives.

No one will be tricked, graded or singled out. This is an opportunity to learn and build a habit that can help protect both individual accounts and university systems.

When the exercise arrives, please take a moment to report the message. A few seconds of practice today can make it much easier to respond quickly when a real phishing email appears tomorrow.

More information about identifying and reporting phishing messages is available at Reporting Phishing Email | ATUS | Western Washington University.