Phishing Emails: Don't Take the "Bait"

Phishing is the most common entry point for serious cybersecurity incidents at universities — more than 90% of data breaches start with a phishing email. Attackers send messages that look like they come from a trusted source (Pitt, a vendor, a colleague, your bank) to trick you into clicking a malicious link, opening a harmful attachment, or handing over your credentials. This article describes what phishing looks like, how to spot it, and the preferred ways to report it so Pitt Digital Security can protect everyone else who received the same campaign.

If a message feels off, don't engage with it. Don't reply, don't select links, don't open attachments, don't forward it to friends to ask their opinion. Report it through the KnowBe4 Phish Alert Button (PAB) in Outlook — that single action sends the message to Pitt Digital Security with the metadata they need, and removes it from your inbox so you can't act on it later by mistake.

How Phishing Works

A phishing email is a fraudulent message designed to impersonate a legitimate person or organization. The attacker's goal is to get you to take a specific action that compromises you or the University.

What phishing attackers are typically after, and how they try to get it
Goal Common Tactic
Your credentials A link to a fake login page that looks like Pitt Passport, Outlook, OneDrive, or a vendor portal. You type your username and multifactor code; the attacker captures both and signs in as you.
Money or gift cards An impersonation of a manager or executive asking you to buy gift cards, wire funds, or change a direct-deposit account "urgently." This is business email compromise, and it has cost universities millions.
Access to your device A malicious attachment or link that installs malware when opened. The malware then steals data, encrypts files for ransom, or pivots to other systems on the network.
Personal data A form or reply that asks for your Social Security number, bank account information, or other sensitive personal data — often framed as a "verification" step.

How to Spot a Phishing Email

Modern phishing — especially with the help of generative AI — no longer has the obvious grammar errors and stilted phrasing of past campaigns. Attackers craft messages that read naturally. The reliable signals are situational, not stylistic.

Common phishing indicators worth pausing on
Signal What to Look For
Unexpected message You weren't expecting it, and the sender has no reason to be contacting you about this topic. This is the single most useful filter.
Mismatched sender The display name says one thing ("IT Help Desk") but the actual email address is something else (a personal Gmail address, an unfamiliar domain, a lookalike of pitt.edu). Hover over the sender's name to see the real address.
Urgency or pressure "Your account will be closed in 24 hours." "Respond immediately." "The CEO needs this done before the end of the day." Urgency is designed to bypass your judgment.
Unusual request Anything outside ordinary process — gift cards, wire transfers, changes to direct deposit, sharing credentials, bypassing normal approvals. Legitimate requests follow normal procedures.
Suspicious link The visible link text says one place but the actual URL goes somewhere else. Hover over the link (don't select it) and read the URL that appears. Safe Links rewrites these to begin with nam01.safelinks.protection.outlook.com — that prefix itself is normal; what matters is the destination encoded inside.
Generic greeting "Dear User," "Hello Customer," or your email username (everything before @pitt.edu) used as a "name." Legitimate Pitt messages typically use your actual name.
Unexpected attachment An attachment you didn't request, especially one named to provoke curiosity ("Invoice.pdf," "Resume.docx," "Voicemail.html"). Don't open it — verify with the sender first through a known channel.
Defender safety tip Outlook may show an inline yellow or red banner — "This sender failed authentication checks," "You don't usually get email from this sender." Take these seriously; Defender for Office 365 is flagging something concrete.
The verification rule.
If an email asks you to take an unusual action — wire money, change a payment account, share credentials, buy gift cards — verify with the sender through a different channel before doing it. Call them at a number you already had (not one in the email). Walk down the hall. Use Teams chat. Phishing relies on you trusting the email itself; a 30-second sanity check defeats the attack.

Reporting a Phishing Email

Reporting phishing is what stops a campaign from spreading. Pitt Digital Security uses your reports to remove copies of the same message from other inboxes, block the sender at the gateway, and warn the community when an active campaign is underway. Pitt supports three reporting methods, listed below in order of preference. Use the highest method available to you.

Scope: these reporting paths are for suspicious messages that arrived in your inbox normally — never for messages you released from quarantine.
A message held in quarantine has already been identified. If you released a quarantined message and then realized it was phishing or spam, simply delete it from your inbox. See Don't Report Quarantined or Released Messages below.

PREFERRED

KnowBe4 Phish Alert Button (PAB)

The PAB is the fastest and most reliable way to report a suspicious message. It is available in Outlook on Windows, Mac, the web, and mobile. One select reports the message directly to Pitt Digital Security, removes it from your inbox, and preserves the full message metadata needed for investigation.

The KnowBe4 Phish Alert button as it appears in the Outlook ribbon — look for the fish-hook icon.

Look for the hook in your Outlook ribbon.

For step-by-step instructions, see Reporting Phishing Emails Using KnowBe4's Hybrid Phish Alert Button.

ALTERNATIVE

Microsoft's built-in Report button in Outlook

If the PAB is not available, use the built-in Report button on the Outlook ribbon (or in the three-dot menu on a message) and select Report phishing. The button's exact location varies by Outlook version — see Microsoft's documentation on reporting phishing in Outlook.

LAST RESORT

Forward as an attachment to phish@pitt.edu

If neither of the above is available — for example, if you are not using Outlook — forward the suspicious message as an attachment to phish@pitt.edu. Forwarding as an attachment is what preserves the original headers and metadata Pitt Digital Security needs to investigate. Do not use this address for spam reports or general questions.
Do not use a standard forward.
A standard forward of a suspected phishing message to phish@pitt.edu strips the headers needed for investigation and may trigger automated security actions on your account. Always report through the PAB or the Outlook Report button when possible, and forward only as an attachment when neither is available.

Don't Report Quarantined or Released Messages

Do not report quarantined or just-released messages as phishing or spam.
A message that was held in quarantine has already been identified and acted on — Pitt Digital Security does not need a second report of it, and a duplicate report adds noise that competes with reports of genuinely missed threats. If you release a message from quarantine and then realize it is phishing or spam, simply delete it from your inbox. Do not use the PAB, the Outlook Report button, or phish@pitt.edu for messages you released from quarantine — those reporting paths are reserved for messages that bypassed the filters and arrived in your inbox unexpectedly. See Managing Spam and Quarantine (Exchange Online Protection) for guidance on releasing messages carefully in the first place.

If You Already Selected a Link or Opened an Attachment

Call the Help Desk — don't use the Report button.
If you may have entered credentials, downloaded a file, or otherwise interacted with a phishing message, call the Technology Help Desk at 412-624-HELP (4357) immediately and ask for Pitt Digital Security. Voice contact lets an analyst assess the impact on your account in real time — what reporting a message cannot do. Early reporting is what makes containment possible.

Simulated Phishing at Pitt

The University periodically sends simulated phishing messages designed to look like real attacks. These simulations are safe — they are sent by Pitt's awareness program through KnowBe4, and there are no negative consequences for clicking one. The goal is to give you a low-stakes opportunity to practice spotting phishing, and to identify topics where additional training would help.

What happens if you select a simulated phishing link.
You'll see a brief educational page explaining what gave the simulation away. Read it — it identifies the specific signals you missed and the technique attackers use in that style of message. Reviewing that page is the entire point of the program. The fact that you clicked is not recorded against you punitively.

Reporting a simulated phishing message via the PAB is correct behavior — the system recognizes that the message was a simulation and credits you for catching it.

Training Resources

Pitt offers a short interactive course on phishing through KnowBe4 — the Phishing Foundations mini-course. It covers how phishing attacks work, how to recognize one in real time, and how to respond. See Pitt Digital Phishing Foundations Mini-Course to enroll.

For related security awareness topics, see:

Protect Yourself Against Future Threats

Pitt Digital is monitoring a surge in targeted spear-phishing attacks — sophisticated scams that incorporate personal details and often arrive from non-Pitt addresses such as Gmail. Your vigilance is what defeats them. The six practices below are the high-leverage things you can do to stay ahead of attackers.

Only approve Duo requests you initiated.

An unexpected Duo push notification means someone else has your password. Decline the request, change your Pitt Passport password immediately at my.pitt.edu, and report the incident to the Help Desk.
Use unique passwords and enable MFA everywhere.

Use a unique password for Pitt Passport and a different password for every other account. Enable multifactor authentication on every account that offers it — a stolen password without MFA is far more dangerous than one with.
Spot and report phishing scams.

Watch for urgency, unexpected senders, requests for credentials, or asks to reply from a personal email. Use the KnowBe4 PAB or Outlook's Report button to send suspected phishing to Pitt Digital Security.
Keep your software updated.

Enable auto-updates for your operating system, browser, and apps. University-managed Macs receive updates automatically; Windows users should ensure Windows Update is active. Unpatched software is the second-most-common entry point for attackers, after phishing.
Complete annual security training.

Search for security training on myPitt to access training powered by KnowBe4. Annual completion is the floor — the simulated phishing program supplements it throughout the year.
Only download apps from trusted sources.

Install apps only from official app stores. For University business, ensure any new application has undergone a vendor security risk assessment before you adopt it for sensitive or restricted data.

For the complete incident-response procedure if something goes wrong, see Report a Security Incident.

Frequently Asked Questions

Select a question to expand the answer.

Key Contacts

Technology Help Desk 412-624-HELP (4357)
Already clicked or interacted with a phishing message, compromised account		 Pitt Digital Security Via Help Desk or PAB
Phishing reports and follow-up investigation
Print Article

Related Articles (7)

Email Protection: Defender for Office 365
Pitt's Microsoft 365 mailboxes are protected by Exchange Online Protection and Microsoft Defender for Office 365, which together guard against phishing, business email compromise, malicious links
(Safe Links), and zero-day malware in attachments (Safe Attachments). This article explains how each layer works, what you may see in Outlook, and how to report a legitimate message that was incorrectly quarantined.
Managing Spam and Quarantine (Exchange Online Protection)
Exchange Online Protection (EOP) filters spam, bulk mail, phishing, and malware on every Pitt mailbox. This article explains the difference between the Junk Email folder and quarantine, how to review and release quarantined messages at security.microsoft.com/quarantine, how to customize your safe-sender and blocked-sender lists, and how to report missed spam or phishing.
Pitt Email and Calendar (Outlook)
Pitt Email (Outlook) is the University's official enterprise email service for students, faculty, and staff — cloud-based Microsoft 365 Exchange Online with 100 GB of storage, integrated calendar, and
automatic spam and threat filtering. This article covers how to access your mailbox from any platform and explains why Pitt Digital strongly recommends against auto-forwarding to third-party providers.
Pitt's DMARC Email Validation
Pitt enforces DMARC Email Validation to keep spoofed phishing out of inboxes and to protect the pitt.edu domain from being spoofed at other organizations. This article explains how DMARC works at Pitt, why some legitimate messages occasionally get quarantined, and what departments using third-party broadcast email platforms like Mailchimp and Campaign Monitor must do to ensure their messages are delivered.
Report a Security Incident
Report suspected security incidents immediately by submitting a Help Desk ticket or calling 412-624-HELP (4357). This article covers what to report — including phishing, malware, ransomware, compromised accounts, unauthorized data disclosure, and lost or stolen devices — along with step-by-step reporting guidance and how to use the KnowBe4 Phish Alert Button.
Reporting Phishing Emails Using KnowBe4's Hybrid Phish Alert Button
By following these steps, users can report phishing emails quickly and efficiently using KnowBe4's Hybrid Phish Alert Button across various Outlook platforms. This helps in keeping your organization safe from potential phishing threats.

If you have any questions or need further assistance, please contact the IT support team at [support email] or call [support phone number].
Social Engineering and Phone Scams
Social engineering is the art of manipulating people into performing actions or divulging confidential information. Social engineering applies to trickery used for information gathering or computer access and in most cases the attacker never comes face-to-face with the victim.

Related Services / Offerings (1)

Security Awareness and Training (KnowBe4)
SECURITY CONSULTING AND EDUCATION KnowBe4 provides security awareness resources to train, promote and reinforce information security best practices.