Designing a Communication That Will Not Be Mistaken As a Phishing Message
Putting together a survey invite, newsletter or other communication for the UBC community that does not confuse faculty and staff can be difficult, especially when UBC Cybersecurity is spending time training employees on what to report. However, there are some common items that faculty & staff typically look for in ascertaining whether a message is trustworthy. When taken into consideration while developing communications and survey invites, the following checklist can be used as a guide to increase the success rate of recipients accepting communications as legitimate:
Sender Address
Where is the communication being sent from?
The communication should be distributed from an @ubc.ca email address and should be recognizable as authoritative for the target audience.
A [CAUTION: Non-UBC Email] warning tag will be added to the top of external email messages to remind recipients to verify the authenticity of the email before clicking on any hyperlinks, opening any attachments, forwarding or responding. The tag is not an indicator that an email is phishing, fraudulent or spam.
UBC communicators that utilize third-party email-sending services can request that the External Email Security Warning Tag not be applied to their legitimate notifications.
It is important to note that exemptions will not be provided for entire services or systems. Instead, exemptions are based on the service’s IP address(es), combined with the sending email address(es) used by the service for incoming emails to UBC. To exempt a service, we require a complete list of the email addresses that the service uses to send emails to UBC mailboxes on behalf of the UBC unit.
Branding
Does the communication use UBC Common Look and Feel (CLF)?
Banners and formatting using UBC branding can increase the legitimacy of your communication.
Salutations
Is the communication being sent to a named person?
Wherever possible, your communication should be sent to a named individual to personalize the message and increase legitimacy
.
Avoid Fear, Uncertainty and Doubt
Does the email contain a message which is creating fear, uncertainty, and/or doubt?
Do not include a sense of urgency or a fear of something bad happening, like the loss of access to a service if the recipient does not act immediately or a benefit if they do.
Signatures
Is the message signed by someone of authority?
Communications should be sent by someone of authority, such that if the recipient has a question or concern they know who to connect directly with.
In cases where it is not appropriate to provide a signatory, such as an initiative or program, include the name of the program along with a general email address that is regularly monitored.
Crafting a Survey
When designing your survey, you should only request the minimum amount of information required from respondents to provide statistically meaningful data.
You should only request personal information from respondents where it is required to provide validity and/or to strengthen the analysis and results of the survey data.
Never request passwords or passcodes from respondents.