In this guide
Slow down a suspicious account request, verify the route independently and keep authentication details out of messages.
Urgency is a reason to verify the request
A message can know your institution’s name and still be fraudulent. A familiar display name, a convincing signature or an apparently local phone number does not establish who controls the request. The important question is whether you can verify the action through a route you obtained independently of that message.
Boston College’s ITS security guidance warns about impersonation, urgent requests, spoofed contact details and requests for passwords or verification codes. Its account-basics material also distinguishes several account and verification concepts. A message that collapses those distinctions into “send us your code to keep all your services” deserves scrutiny, not obedience.
Do not let the message choose every step
If a message claims a university account needs attention, avoid using its link or supplied callback number as the sole test of authenticity. Open a previously verified university page yourself and find the relevant support route there. This separates the claim from the channel used to check it.
A search result is not automatically a verified destination either. Check that the source is the relevant official BC page and that the action makes sense for the service. Campus Taskbook is an independent reading site. It has no account form, cannot inspect a BC account and never needs a password, recovery code or authentication approval.
A fictional message and a safer question
Consider an invented email saying that a student’s course materials will disappear unless they confirm an account within fifteen minutes. It links to a plausible-looking page and asks for both a password and a code. The presence of a course name makes the message feel personal, but does not authenticate the sender.
The useful question is “Does the relevant official service show a real issue, and what does BC’s verified support guidance say?” The unsafe question is “How quickly can I satisfy this message?” Do not approve an unexpected verification request merely to make it stop. Use the official account-security route to investigate.
Report the event without spreading the secret
BC publishes reporting directions for suspicious messages and suspected compromise. Read the current official guidance and follow its appropriate channel. If you describe the event, separate facts from conclusions: what arrived, approximately when, what it asked you to do and whether you interacted. Do not send authentication secrets to this publication or put them in a public screenshot.
If information was already disclosed, seek official help promptly. A public article cannot determine whether an account is safe, reverse an action or guarantee that changing one setting resolves the problem. Follow the institution’s current response instructions rather than improvising from an old social-media post.
Build a small habit before the next incident
Keep a verified official support bookmark on a device you control. Review the institution’s current account-recovery and verification guidance while you are not under pressure. The goal is to know where to begin if your usual device becomes unavailable, without storing secrets in an ordinary note or sharing access with someone else.
Reporting guidance can evolve. BC’s dated ITS news items are evidence of what was advised at that time, while the current account and support pages are the place to confirm present instructions. This guide offers a verification habit, not a security audit of any message, device or account.
Read next: Find the task behind the portal, or Helping with a bill does not require sharing an account.