2. THE DHS PHISHING IQ TEST PART 1

3. LEGITIMATE EMAIL V PHISHING EMAIL How do you know if an email is legitimate, or is a phony, phishing email? Take the DHS Phishing IQ Test, and well show you what to look for in a phishing email. The best way to avoid getting phished is to NEVER CLICK ON LINKS IN EMAIL THAT ASK FOR YOUR IDENTIFYING INFORMATION. 2014 DHS IT Security & Privacy Training 2

4. INSTRUCTIONS FOR THE DHS PHISHING IQ TEST You will see an example of an email on the screen. Decide whether it is legitimate or phishing. 2014 DHS IT Security & Privacy Training 3

5. LEGITIMATE OR PHISHING? 2014 DHS IT Security & Privacy Training 4 Legitimate Phishing Which answer? This email is supposedly a message from PayPal stating you have added a named person to your PayPal account. The message threatens to suspend your PayPal account if you do not respond.

6. If you download, complete, and send the Personal Profile Form at the end of this email, you may have given away your personal information. Remember, don't use the links in an email, instant message, or chat to get to any web page if you suspect the message might not be authentic or you don't know the sender. 2014 DHS IT Security & Privacy Training 5

7. LEGITIMATE OR PHISHING? 2014 DHS IT Security & Privacy Training 6 Which answer? LegitimatePhishing This email is supposedly a notification from Facebook. It provides a link to click to remove the message.

8. One way you can tell is to put your cursor over the link, then look at the link in the bottom of the browser. Do they match? This doesnt. So its easy to see this is phishing for your information. Remember, don't use the links in an email, instant message, or chat to get to any web page if you suspect the message might not be authentic or you don't know the sender. 2014 DHS IT Security & Privacy Training 7

9. LEGITIMATE OR PHISHING? 2014 DHS IT Security & Privacy Training 8 Which answer? Legitimate Phishing This email is supposedly from Prevention Magazine. It is for a subscription confirmation.

10. This email was legitimate. The receiver was a subscriber to the magazine and she later received a paper bill through the USPS mail. However, the receiver was not sure if the email was legitimate, so she did not use the links in this email to get to the web page. 2014 DHS IT Security & Privacy Training 9