Track the Threat: Recognizing Phishing and Social Engineering

Phishing has evolved far beyond suspicious emails. Today’s scams can come through texts, phone calls, QR codes, social media, and even in-person interactions all designed to manipulate people into taking action. Learn how these social engineering tactics work and what to watch for.

Phish Files presents Cybersecurity Awareness Month 2026

Phishing is no longer limited to suspicious emails anymore. Today, cybercriminals use text messages, emails, phone calls, QR codes, social media, and even in-person interactions to trick people into giving up information, sending money, clicking a link, opening a file or providing access.

These types of attacks are a form of social engineering, which means tricking people into taking action on behalf of the attacker. Instead of relying on technical tricks, they can exploit human emotions such as urgency, fear, trust, or the promise of a reward.

Knowing the PHISHING Pattern

One way to recognize these tactics is remembering PHISHING:

P • Pressure: “Your need to act right now.”

H • Helpfulness: “Can you help me get into that office?”

I • Impersonation: “I’m calling from IT, your bank, or your supervisor.”

S • Suspicion: “This request feels odd.”

H • High Stakes: “Your account will be suspended if you don’t act now,”

I • Interest: “We have an exclusive remote job for you!”

N • Need to Know: “Please send me your Duo code so I can help.”

G • Greed: “You could make $500 a day.”

These tactics can appear in many forms. A message could direct you to a fake login page that looks like SSO. That text claiming there’s a problem with your account. A call pretending to be a friend or family member.

Watch for the Pattern, Not Just the Message

The details of a scam can change, but the strategy is often similar.

Build Trust → Create a reason to act → Apply pressure → Request an action → Exploit the response

Before interacting with an unexpected request, stop and ask:

Was I expecting this?
What information or action are they requesting?
Why would they need it?
Do I know who is actually asking?
Can I verify the request through an alternative, trusted source?
What happens if I take a moment before responding?

If something feels off, take a second before replying, clicking, sending, or providing access.

See Something Suspicious? Report It.

Reporting suspicious activity helps protect more than just you. Information Security can investigate reported messages and identify threats that may also be targeting other members of the campus community.

If you receive a suspicious message, use the Phish Alert Button (PAB) to report it directly to Information Security. If you cannot use the PAB or have screenshots of messages, forward relevant information to phishfiles@montclair.edu.

You do not need to be certain that something is malicious before reporting. When in doubt, report it.

Remember: Always trust your instincts and verify before you interact.