Beware of W2-related Cybercrime Schemes

Tax related phishing attempts frequently occur, because criminals would love to get their hands on your W-2 so they can steal your identity and/or your tax refund.  This article (new for 2018 tax season) is posted to share with you what you should expect. The image posted with this article is an example of what a legitimate W-2 email sent from Ohio State looks like.  

Key characteristics of OSU sent W-2 emails: 

1. Email does not contain any links
2. From address is from an OSU domain, specifically OSU_SIS-HR_System-DoNotReply@osu.edu

Remember, here are a few the indicators you can look for to spot a phishing email:

• Were you expecting it? Messages from unknown senders are an obvious red flag, but cybercriminals are also known to use email addresses that look like they came from OSU or another legitimate organization.
• Are there spelling and grammar errors? Phishing messages may contain poor spelling and grammar. If a message has multiple errors, that is a good indicator that it could be a phish.
• Are the links legit? Links can be deceptive and may appear to include domains you know. Hover over a link before you click to see if it's pointed to a legitimate site.
• Is it getting personal? Phishers try to gather personal information about you so they can do things like steal your identity or empty your bank account. Never provide information via email; verify that the request is real.
• Are they in a hurry? Cybercriminals want you to act quickly, without thinking about the repercussions. Be suspicious of claims that a matter is urgent and must be attended to immediately.
• Are you being asked to download or install something? Be careful opening attachments to emails and visiting websites.  Some websites install malicious software on your computer just by visiting them or will prompt you to install content or download a file. If you are instructed to do this, always say no. 

Most importantly…don’t be embarrassed if you click on something suspicious…SAY SOMETHING! 

If you think you may have clicked on a link in a phishing email, please report by using your report phish button (if applicable) or forwarding it to report-phish@osu.edu.