What makes this a phish?

When you get an unsolicited file or document to review, it is best to check the sender and ensure that you are expecting the email. In this instance, the message claims that Mark Foust sent the document; however, the actual sender’s email address does not match his NISD address, which should be a red flag. This phish uses emergency preparedness training to make the request appear legitimate and encourage staff to click the link inside the attachment. Once on the landing page, you can see that the “Authentication Required” page is actually a Google Form asking for your email address and password, rather than NISD’s sign-in portal. The form even includes a warning at the bottom stating, “Never submit passwords through Google Forms.” Contacting the supposed sender through a separate, known communication method to confirm the request would help protect your account. Be careful what you click on, even if it uses a familiar name or appears to be an official district request!