Your Internet/Email Account

As part of an ongoing University-wide effort to increase online security, passwords for University Internet (email) accounts will now be set to expire after one year. Internet passwords are used for most common online applications such as e-mail, wireless access, course registration, UMCal, and pay statements.

Beginning February 18, email notices will be sent in stages to UMD students, faculty or staff who have an Internet password older than one year. The email will include the expiration date for the password, as well as instructions on how to change it. Customers will have two weeks from the date of the email to change their password. For uninterrupted access, you must set a new password before the current one expires.

If you would like to reset your Internet password now:

1. Under Quick Links (left), click on the link labeled "Change your Internet Password".
2. Under Passwords/Security, click on the link labeled "Change your Internet Password".
3. Review the current password rules displayed on the page.
4. Enter your new password in both boxes (to prevent typing errors).
5. Press the 'Submit' button.

You should see the message: "Password changed to " for confirmation.

"Change your password" phishing emails

Unfortunately, a number of faked emails have also been circulating to universities across the country that also request the user to update their "University" account by clicking on a link or replying to the email. If a person replies, the account information is then used to send large amounts of spam. Several UMD accounts have already been compromised in this manner.

So, how can you tell the real email from the fake email?

• The University will never ask you to reply to an email with your password. You will always be asked to go to the University's web site to change your password. Here's one way to get there from the ITSS Home page (www.d.umn.edu/itss/)
  • Under Services, click on the "Email" link.
  • Under Quick Links, click on the "Change your Internet password" link.
• Check the "From" and "Reply to" addresses for obvious imposters, although these can be faked to look legitimate as well. Some of the recent emails came from "yahoo" accounts, for example.
• Don't click on links in an email without verifying that it's a legitimate University web site.
• If you receive a phishing email that targets University email users, report it to abuse@umn.edu.
• If you have questions or concerns about an email you receive, please contact the ITSS Help Desk (726-8847).

Below are a few of the recent phishing emails. If you think you may have replied to one of these or another phishing email, you should reset your password now.

4.04.08
Subject line: "Update Your Email Address"

This fake email includes a spoofed address (UMN Email Admin<mailadmin@umn.edu>) and a link to a malicious web site.

03.29.08
Subject line: "Account Reactivation"

This fake emails asks for your University email account, password, date of birth and your country.

1.30.08
Subject line: "VERIFY YOUR UMN (or EMAIL) ACCOUNT NOW"

This fake email asks for your UMN email account and password.

For reference, a copy of the legitimate email that is being sent by the University is shown below.

Your Internet (email) password is expiring and must be changed.  Go to
https://www.umn.edu/myaccount

For more information, read on.

As part of an ongoing University-wide effort to increase online
security, the Department of Audits has requested that all Internet
passwords expire one year from the date they are set. Internet passwords
are used for most common online applications such as e-mail, wireless
access, course registration, UMCal, and pay statements.

You are receiving this notice because your Internet password is more
than one year old and will expire on $EDATE. We are writing to
you today to inform you that you must take action within the next two
weeks to change your Internet password. For uninterrupted access, you
must set a new password before the current one expires.

To reset your password, go to https://www.umn.edu/myaccount
- Click on the link labeled "Change your Internet Password".
- Review the current password rules displayed on the page.
- Enter your new password in both boxes (to prevent typing errors).
- Press the 'Submit' button.
- You should see the message: "Password changed to " for
confirmation.

Please note: if you do not change your password by $EDATE, your
access will be limited such that you can only change your password when
you attempt to log in to password-restricted resources. You are able to
change your password yourself by following the prompts. After the new
password is set, your access will be immediately restored automatically.

A copy of this notification can be found at
http://www.d.umn.edu/itss/email/pwchange.html. If you have any questions, 
need assistance, or cannot remember your current Internet password, please
call the ITSS Help Desk at 8847.

____________________________________________
Linda Deneen, Director
Information Technology Systems and Services
University of Minnesota Duluth
ldeneen@d.umn.edu
(218) 726-7588