Phishing Awareness Guide for Students and Staff

How phishing works, what today's attacks look like on campus, and a simple 4-step habit everyone can use to stay safe.

For All students and staff

Why campuses are targeted

Institutions hold personal data, fee payments, research and credentials that give access to many other services. Attackers send messages that look routine — a fee reminder, a scholarship, a password reset, a "document shared with you".

What phishing looks like now

Credential harvesting: a link to a fake login page that copies your institution's sign-in.
Business email compromise: a message that appears to come from a principal, HOD or vendor asking for an urgent payment or gift cards.
QR code phishing ("quishing"): posters or emails with a QR code that opens a malicious site.
Messaging apps: WhatsApp or SMS messages impersonating staff, placement cells or banks.

The 4-step habit: STOP

S — Sender. Check the real email address, not the display name. Hover before you click.
T — Tone. Urgency, secrecy, threats or unusual rewards are warning signs.
O — Open nothing from the message. Go to the service directly by typing the address you know.
P — Pass it on. Report it to your IT helpdesk so others are warned.

If you clicked

Change the password for that account immediately, and anywhere else you reused it.
Turn on multi-factor authentication.
Tell IT — early reporting limits the damage, and nobody should be blamed for reporting.

For IT teams

Enable MFA for everyone, starting with staff and admins.
Configure SPF, DKIM and DMARC for your domain to make impersonation harder.
Run short, regular simulations and share results as learning, not punishment.