Learn about email security including identifying fraudulent emails, email encryption, Google 2-Step, and more.
How to Identify Fraudulent Emails
Cyber criminals use compelling email messages to trick you into clicking a link, downloading an attachment, or replying to an email. Once you have reacted to their message, they steal sensitive information or install malicious software on your computer.
When interacting with email, do not rely on any single approach to identifying a scam, know all the possible signs (especially #4):
An urgent subject line, language prompting you to act quickly.
A direct email you were not expecting (even if it appears to be from someone you know, or someone at 51茶馆).
- Be aware, occasionally a legitimate 51茶馆 email account is hacked, and used to send scam emails to other 51茶馆 community members.
鈥淔rom鈥� addresses with sneaky variations of (legitimate) email addresses. Examples: Ending in @bc-edu.org instead of @bc.edu
- Get in the habit of checking the from/signed by.
听
- Messages from a 51茶馆 person or department that do not have an @bc.edu in the email address should be viewed with extreme skepticism.
- A sender name is easy to fake.
- If you aren鈥檛 sure if an email is authentic, instead of replying, contact the sender using information you already have about them (such as their 51茶馆 email address from the 51茶馆 Directory).
- Never click on an attachment you were not expecting. You could unknowingly download a virus or ransomware to your device.
- Just because it looks like a 51茶馆 sign in page doesn鈥檛 mean it is!
- Any link that takes you to a form that looks like the 51茶馆 sign in page BUT has a non-51茶馆 web address, is a SCAM.
- 51茶馆 will NEVER ask for a password unless it is on an official 51茶馆 login screen. Official login screens always have bc.edu before the first single, forward slash (/), for example:
https://login.bc.edu/nidp/idff/sso?id=19&sid=0&option=credential&sid=0
- Just because it looks like a Google sign in page, doesn鈥檛 mean it is!
- Scammers also create log in pages that look like Google log in screens, but aren鈥檛! Instead they are just hoping to steal your credentials and access your Google account.
- Official Google log in screens always have google.com before the first single, forward slash (/), for example:
https://accounts.google.com/v3/signin/identifier?authuser
=0&continue=https%3A%2F%2Fmail.google.com%2Fmail&ec
=GAlAFw&hl=en&service=mail&flowName=GlifWebSignIn&flowEntry
=AddSession&dsh=S606954128%3A1728478423789165&ddm=1
https://docs.google.com/document/d/1uIGZq3yh5sE_d9N-fA4GOZKO5zxrwMGaEKyUHtcA4hY/edit
- Hovering over a link to see the web address can helpful. However, many departments on campus use third party email marketing tools to send messages, which can cause a link to a legitimate web page to look like 鈥渉ttps://t.e2ma.net/click/p0obxi/lt0szkrb/haz7hu鈥�. In those cases, when it doubt, go to www.bc.edu website and search for the information mentioned in the email.
Typos, odd phrasing, unnecessary capital letters are often indicators of a scam.
听
Official 51茶馆 emails will not have QR codes in the body.
听
What to do if you receive a fraudulent email
- Do not reply to the email, or text/call any phone numbers included in the email.
- Do not click on any links听 or attachments in the message.
- If possible, in Gmail, click the three dots in the upper right corner and select, 鈥淩eport phishing鈥� or 鈥淩eport spam.鈥澨�
- Forward it to phishing@bc.edu.
听
Think You've Been Compromised?
Report a Security Incident
If you think you鈥檝e been the victim of a phishing email, email听security@bc.edu听to report it. A member of the IT Security team will follow-up with you.
Protect Your Account
- Change your 51茶馆 Password and 51茶馆 Gmail Passwords.听Phishing emails often target your credentials so they can access your email account, or your 51茶馆 account, and gain access to your private data. Change your passwords, and take away their access.
- Change other passwords. If you use your 51茶馆 passwords on any other accounts, change those passwords as well.
- Log out of all other Gmail Sessions. If a bad guy got a hold of your 51茶馆 Gmail login, they may be logged into your account. Kick them out! In the bottom right corner of Gmail, click Details and then Sign out all other web sessions.
- Check your Sent Mail folder.听Bad guys often use compromised email accounts to send malicious messages to others in your contacts. If you see emails were sent from your account which you did not send, this would confirm your account has been compromised, and will let you know who has received an email from your account.
- Check your mail forwarding settings.听Bad guys often enable mail forwarding, so messages sent to your email will be forwarded to an account of their preference. Disable unwanted email forwarding by going to Settings > Forwarding and POP/IMAP > Disable forwarding > Save.
- Check your Google email settings and remove any suspicious accounts.听Go to Settings > Accounts > Send Mail As.
- Report the email as phishing in Gmail. Learn .
- Scan your computer for malware or viruses.
Email Security
Electronic Abuse
While Boston College strives to provide an open computing environment to foster collaboration and learning, there are policies defining appropriate use of the 51茶馆 network and computing resources, such as email. Before reporting electronic abuse, make sure you are familiar with听51茶馆's computing policies and guidelines.
Examples of Electronic Abuse and Appropriate Action to Take
- Your system/server has been or is being attacked: Report the abuse immediately and do not make any changes to the system until you hear from the ITS security team on campus. You may accidentally remove vital information that can be used as evidence.
- You received offensive or threatening email or voicemail: Do not delete the offensive message as it can be used as evidence.
- You suspect someone knows or is using your 51茶馆 password: Report the compromise immediately with any substantiating evidence. Change your password immediately.
- You are aware of software copyright violations at Boston College.
Report Electronic Abuse
Send an email to abuse@bc.edu听describing the electronic abuse. You must show the full message headers of any email message that you are forwarding. Do not delete the email from your inbox until you have heard back from us.
Encrypted Email with Virtru
If you need to send confidential emails as part of your job, you may want to consider requesting Virtru. Virtru is an email security tool that allows you to:
- encrypt emails
- prevent a forwarded encrypted email from being read
- set a read expiration date on encrypted messages听
- and revoke the ability to read an email after it is sent
听
Getting Started with Virtru
If you think you may need this service, contact your Technology Consultant. Once approved, install Virtru for Gmail or Outlook. 听
Email recipients do not need to install Virtru to read or respond to your email. Recipients of an encrypted email will not be able to access the message directly from their inbox. Rather, they will be prompted to "unlock" the message, and verify their email address.
ITS recommends you inform your recipients to expect an encrypted email, since they will be prompted to take extra steps to unlock the message. The best way to do this is to add a customized intro to your message.听Be sure to include information that only your recipient would know, or write it in such a way that they know it's really you.
Partially.听You can install the Chrome plug-in, which will allow you to decrypt and respond to any Virtru messages sent to you. However, you will not be able to initiate a Virtru encrypted email.
You must be enrolled in Google 2-Step Verification in order to access 51茶馆 Google services (Mail, Drive, Calendar).听Failure to enroll will result in loss of access to your 51茶馆听Google account (Mail, Drive, etc.). To unlock your account you will听need to contact the 51茶馆 Help Center.
Google 2-Step Verification (also known as two-factor authentication) adds an extra layer of security to your account in case your password is stolen.
- Download the Gmail app on your mobile device (optional but highly recommended): | . Even if you prefer to use a different email app on a daily basis, adding the Gmail app will help simplify 2-step verification. After downloading it, configure Gmail for your 51茶馆 account.
- Enroll in 2-Step:听Go to the and follow the prompts. Set up the Google Prompt option (via the Gmail or the Google [Search] app on your device).
- Configure at least one other backup option.
Tip: In case you don鈥檛 have access to your phone, it is a good idea to set up backup codes. Then print the codes & put them in your wallet.
Once you鈥檝e enabled 2-Step, when you access your 51茶馆 Google account (Gmail, Drive, Calendar, etc.) from a new device, it will require both your login information and a secondary verification.
听
Frequently Asked Questions
2-Step Verification (also known as two-factor authentication, multi-factor authentication [MFA], or 2FA) adds a second layer of protection to the login process. 2-Step Verification combines something you know (your password) with something you have (a phone or code). You most likely already have experience using 2-Step Verification with Eagle VPN or with an online bank account.
Google 2-Step adds extra security, and helps safeguard you from phishing scams and ransomware. This additional protection aligns with best practices in account security, and is a new compliance requirement for 51茶馆鈥檚 cyber insurance coverage.
ITS recommends you use the Google Prompt option (via the Gmail or the Google [Search] app on your device), and configure at least one other backup option.
In case you don鈥檛 have access to your phone, it is also a good idea to set up backup codes. Then print the codes & put them in your wallet.
In general, you will need to use 2-Step the first time you access your Google account using a new device. Once you log into your 51茶馆 Google account (Gmail, Drive, Calendar, etc.) and complete 2-Step Verification on your phone or computer you will have the option to 鈥渞emember this device.鈥� After that, Google will not prompt you for 2-Step Verification on that device unless you change your password or if Google suspects that your account has been breached.
No, it does not. Google 2-Step Verification is different from 51茶馆 2-Step Verification:
- 51茶馆 2-Step Verification uses Duo to verify your identity and login to secure 51茶馆 services such as Eagle VPN, MyBill, PeopleSoft HR, and Peoplesoft Financials. For more information about 51茶馆 2-Step Verification, visit bc.edu/2step.
- Google 2-Step Verification adds an extra layer of security to your 51茶馆 Google account. You must set up Google 2-Step Verification separately from 51茶馆 2-Step Verification.
If you don't have a mobile device, you have a few options for 2-Step set up:
- Use a land line phone to receive a voice call.
- Set up backup codes.
- Use an authenticator app on a web browser.
Before enabling 2-Step within your Google account, make sure you are running the latest version of your email client that supports a special protocol called 鈥淥Auth2.鈥�
Apple Mail
You need to be using macOS Catalina (v. 10.15.4) or higher听to do Google 2-Step in Apple Mail.
Outlook
You need to be using Office 2019 or higher to do Google 2-Step. The version of Outlook that comes with Office 2016 does not support OAuth2.
Thunderbird
Step 1: Make sure you are running the latest version of Thunderbird:
- Select 鈥淗elp鈥� -> 鈥淎bout Thunderbird.鈥� If an update is available, install it.
Step 2: Make sure you are using 鈥淥Auth2鈥� for inbound and outbound mail settings:
- From the top right menu, select the 3 vertical bars and select Account Settings.
- On the left, select Server Settings and on the right make sure the 鈥淎uthentication method鈥� is set to: OAuth2
- On the right, select 鈥淥utgoing Server (SMTP)鈥�:
- Edit the outbound email server name to: smtp.gmail.com
- Make sure the 鈥淎uthentication method鈥� is set to: OAuth2 - Close Thunderbird and then restart it.听
- The first time you send or receive email, you will be prompted to log into your Google account. When prompted, allow Thunderbird access to your account.
Yes, but only as an authenticator app to get a passcode for 2-Step. Duo will not send push notifications like it does for VPN or Peoplesoft. To get push notifications, you need to install the Gmail app or the Google (Search) app.
Using Duo Mobile as Your Authenticator App
To set up Duo Mobile app for your authenticator app:
- Follow using an authenticator app. Ignore any mentions of Google Authenticator or other mobile applications 鈥� you'll be using Duo Mobile instead.
- Follow the "Third-Party Account Setup" instructions on the . Important: When the barcode appears, open your Duo Mobile app. DO NOT DOWNLOAD Google's Authenticator app (as instructed on the screen).
To use Duo Mobile app as your authenticator app:
- When prompted to validate on Google, you will be instructed to use the Google Authenticator app. Instead, use the Duo Mobile app to get the passcode.
In case you don鈥檛 have access to your phone, it is a good idea to set up backup codes. Then print the codes & put them in your wallet.
If you don't have access to any of your enrolled secondary devices or backup codes, contact the 51茶馆 Help Center at 617-552-HELP (4357) for assistance.
Be sure to install the Gmail app, so you can receive Google prompts on your phone when you are connected to a secure wireless network.
In case you don鈥檛 have access to your phone, it is a good idea to set up backup codes. Then print the codes & put them in your wallet.
If you don't have access to any of your enrolled secondary devices or backup codes, contact the 51茶馆 Help Center at 617-552-HELP (4357) for assistance.
Please do not share your login credentials with another person. Instead, .
You may have set up your 51茶馆 Google account on your iPhone as a Microsoft Exchange account. You can resolve this problem by removing the account and re-adding it as a Google account by following these steps below:
- Remove the Microsoft Exchange Account:
- Go to Settings听>听Mail听> Accounts, then select your 51茶馆 Google account and click Delete Account.
- Re-Add it as a Google Account:
- Go to听Settings > Mail听> Accounts听> Add Account, select Google
- At the Google sign-in page, enter your 51茶馆username@bc.edu, then tap听Next.
- Enter your Secondary Password, then tap听Next.
- Toggle the settings you want to add to the phone (calendar, contacts, etc), then tap听Save.
听
If the app doesn鈥檛 offer 鈥淪ign in with Google,鈥� you can either:
- Switch to a more secure app or device听
- Use App Passwords
When you use Google 2-Step Verification, some less secure apps or devices may be blocked from accessing your Google Account. App Passwords are a way to let the blocked app or device access your Google Account.
Please make sure you are enrolled for your 51茶馆 Google Account and not a personal account. To see if Google 2-Step is enabled, be sure you are viewing your 51茶馆 Google account, and visit:
If you do not turn on 2-Step, forwarding will continue to work, but you won鈥檛 be able to log into your 51茶馆 Google account. To access your account, you will need to contact your TC, the Help Center, or go to the Walk-In Help Desk.
New students, faculty & staff: You have 1 week to set up Google 2-Step Verification after you first login to your 51茶馆 Google account. If you do not set up Google 2-Step within this time, you will get the message below when attempting to sign into your 51茶馆 Google account. To access your account, you will need to contact your TC, the Help Center, or go to the Walk-In Help Desk.
听
Shared Google Account FAQ
- Only one person (the 鈥渙wner鈥�) should have the password for an account and that person is responsible for that account.
- The 鈥渙wner鈥� of the shared account should set up Google 2-Step verification with multiple verification methods (and at least include a department phone).
- All other people accessing the shared account need to be set up as delegates. Learn . (video by Google).
Security Note: Sharing passwords with others is not secure. If Google detects multiple logins from different devices at the same time, it will assume the account is compromised and suspend it. Please give anyone who needs access to the account delegate access.
Boston College implemented a Phishing Simulation program to increase awareness and education related to phishing emails, therefore decreasing the risk of exposure of University data.听Phishing simulation is ongoing for all students and for select faculty and staff, by department request.
Why is 51茶馆 Doing This?
Colleges and universities continue to report increased phishing incidents in which bad actors try to trick people into clicking on malicious links in an effort to steal passwords, access personal or University data, and in some cases encrypt data and demand money for the data to be unencrypted.
Sample Phishing Simulation Educational Web Page
If you mistakenly click on a phishing simulation email link or attachment, you will be taken to a web page that听explains which characteristics of the email were clues of a typical scam.
Sample Phishing Simulation Email
