Connect

Scammers are always on the lookout for new ways to get your personal, professional, or financial information. The best way to protect yourself is to recognize a scam.  

How do you avoid being a victim of a social engineering attack or scam?

• Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company.
• Do not provide personal information or information about your organization, including its structure or networks, unless you are certain of a person's authority to have the information.
• Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email.
• Don't send sensitive information over the internet before checking a website's security. Pay attention to the Uniform Resource Locator (URL) of a website. Look for URLs that begin with "https" — an indication that sites are secure — rather than "http.”
• If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly.
• Use multi-factor authentication (such as Duo) on all possible online accounts.

What do you do if you think you have been impacted by a social engineering attack?

• If you believe you might have received a phishing email at your UVA Health address or revealed sensitive information about your organization, report it immediately to the UVA Health Security team.

If you suspect that you have received a phishing email,
forward the email to 
MCCSecurity@hscmail.mcc.virginia.edu

• If you believe your financial accounts may be compromised, contact your financial institution immediately and watch for any unexplainable charges to your account.
• Immediately change any passwords you might have revealed. If you used the same password for multiple resources, make sure to change it for each account, and do not use that password in the future.
• Watch for other signs of identity theft and visit the FTC’s Identity Theft website

Additional Resources

• UVA Health Security Awareness Resource Page (Smishing, Vishing, and Phishing)
• What to do about scam calls and texts
• The latest from the Federal Trade Commission on Consumer Scams