CSUN Spam Prevention

Phishing and spam continue to target CSUN students, faculty and staff. Today's scams may arrive through email, text messages or QR codes and can be difficult to recognize because they often appear to come from trusted people or organizations.

CSUN uses email security tools, including Proofpoint, to help detect phishing, fake job offers, malicious links and attachments, and suspicious senders. However, no security system can stop every threat, so awareness remains an important part of protecting your CSUN account and personal information. 

Common Scams at Universities

Students, faculty and staff should watch for:

  • Fake jobs and internships offering high pay with little or no interview or asking you to deposit a check.
  • Faculty or supervisor impersonation asking for a "quick favor," your phone number or an urgent response.
  • Gift card scams requesting that you purchase cards and send the codes.
  • QR code phishing directing you to fake CSUN, Microsoft or MFA login pages.
  • MFA scams asking for verification codes or unexpected approval requests.
  • Text-message phishing (smishing) asking you to click a link, send money or provide personal information.
  • Extortion scams demanding cryptocurrency or claiming that your computer or account has been compromised.

CSUN has documented phishing attempts involving fake internships, fraudulent MFA instructions, QR codes, text messages and cryptocurrency/extortion scams. Reviewing real examples can help you recognize similar tactics.

Phishing Is Getting Harder to Spot

Don't rely on spelling and grammar mistakes to identify phishing. Attackers can now create polished, professional-looking messages, copy university branding and impersonate trusted organizations and individuals.

The 2026 EDUCAUSE Students and Technology Report, based on responses from 8,622 students, found that 46% encountered a security threat during the previous academic year. Cybersecurity awareness is an important responsibility across higher education.

Remember P-H-I-S-H

Use P-H-I-S-H before responding to a suspicious message:
 Remember... Clues  Description
PPrivate information & DataNever provide passwords, MFA codes, banking information or other sensitive information.
HHyperlinks or attachments do not look rightBe cautious with unexpected links, QR codes and attachments. Check where a link leads before clicking.
IInformation, Inaccurate or poorly wordedQuestion messages that don't make sense or that you weren't expecting. Look for obvious grammar, spelling and punctuation errors
SSuspicious senderCheck the actual email address, especially when the sender claims to be a professor, supervisor or university official.
HHurry up and respondBe suspicious of messages pressuring you to act immediately or threatening consequences if you don't respond.

Before You Click

Ask yourself:

  1. Was I expecting this message?
  2. Does the sender's actual email address match who they claim to be?
  3. Is someone asking for my password, MFA code, money or personal information?
  4. Is the message creating unusual urgency or asking me to keep something secret?
  5. Does the link or QR code lead where the message claims?
  6. Can I verify the request through another trusted method?

If You Receive a Suspicious Message

Stop. Verify. Report.

Do not click suspicious links, scan unexpected QR codes, open unknown attachments, approve unexpected MFA requests, or send money or gift card codes.

Report suspicious email to abuse@csun.edu. When possible, send the suspicious email as an attachment so CSUN Information Security can review the message and its headers.

If you entered your CSUN password on a suspicious website or approved an unexpected MFA request, change your password immediately and report the incident to CSUN Information Security.

Remember: A CSUN logo, familiar name or professional-looking message does not guarantee that a message is legitimate. Verify unusual requests before taking action.

Questions

Contact the IT Help Center or visit IT Security.