Phishing: What to do After Suspected Phishing

For more information on what a phishing attack is, see here (link opens in a new tab). If you:

click on any of the links in a phishing email
send any personal information in response to a phishing email

Then there are some security steps you need to take to ensure that your account and data are secure.

After Phishing

Report the Phishing Message (link opens in a new tab)
Inform the Helpdesk: If you email us from an account other than your regular Carleton account (for example, if you aren't able to use your Carleton account as it is compromised), there is an increased chance that your email will go to spam. Call us or make a ticket (link opens in a new tab), or come in-person (if possible).
- If the Helpdesk does not know that you have been phished, we cannot help you with securing your account until we notice more overt signs.
Change your Carleton password (link opens in a new tab)
- If your account is compromised and you are locked out, this step will not work. In that case, contact the Helpdesk.
Check Active Google Sessions and log out of all of your active Google Sessions from Google's Manage Devices page. (link opens in a new tab)
Log Out of ALL your Google Accounts: On the device that you clicked on the link or sent the information by, sign out of all of your Google accounts (on the Google website, in Google apps, etc)
1. Click your portrait in the top right corner of any Google page.
2. Click Sign out
3. Do the same for any other Google accounts you are signed into on your computer.
Run a ThreatDown (aka Malwarebytes) Scan (if you're on a Carleton-provided computer):
1. Right-click on the or icon in your taskbar area, near your computer's clock
2. Select Start Threat Scan
Look at your Gmail filters
- In Gmail, check in Settings > See all settings > Filters and Blocked Addresses to make sure the attacker hasn't added or tampered with your filtering or blocked addresses in any way.