What is a Login Theft Scam?
Threat actors create sophisticated scams to steal your U-M login credentials. They use false pretenses, such as a party invitation or a request to review a document.
 |
 |
How it Works
Scammers send you an email directing you to enter your uniqname, password, and phone number on a webpage or in a form. They use the information to initiate U-M login, then ask you to send them the Duo-generated passcode so they can complete the authentication process and gain access to your account.
With this access, scammers can:
- Redirect your paycheck deposit
- Redirect financial aid payments
- Apply for emergency hardship loans in your name
- Gain entry to sensitive U-M systems and data
- Use your U-M account to carry out further scams, and more.
What to Watch Out For
- Beware of suspicious emails designed to lure you into providing personal information under false pretenses.
- Messages or forms may be designed to look like they are from U-M, familiar services such as Dropbox, or evite vendors such as Paperless Post.
- Red flags that it’s a phishing attempt:
- A login page or login form asking for your phone number.
- If you are asked for your email address and password a second time to confirm.
How to Protect You and U-M
- Only enter your uniqname and U-M password on the official U-M Weblogin screen (weblogin.umich.edu) or UM-managed Microsoft Office 365.
- Do not enter Duo passcodes into any forms other than the official Duo screen.
- Do not share Duo verification codes, passcodes, or accept Duo push notifications unless they are initiated by you, or requested by the ITS Service Center to verify your identity when you call for support.
- Pay attention to warnings: Google forms warn you to never enter login information into a Google form.
- Report phishing and email abuse. Send the full message with headers to [email protected].
If You Get Caught
If you shared your login information under suspicious circumstances, your account has likely been compromised.
- Change your UMICH password immediately and follow the instructions at What to Do if Your Account is Compromised.
- Report the incident to the ITS Service Center.
- Carefully review the activity on any account that became vulnerable as a result of responding to the scam.