Carnegie Mellon University
Computing Services  ›  Information Security Office  ›  Training and Awareness  ›  Don't Take the Bait  ›  Look Before You Log In

Look Before You Log In

When you log in on to a site using the Andrew Login page, always check the URL before you enter your password. Many people at CMU receive phishing emails with links to fake Andrew Login pages. The fake pages look exactly like the real one. When people log in to the fake page, their password is stolen, and their CMU account is compromised. The only clue that the page is fraudulent is the URL.

Before entering your Andrew ID and password on any web page utilizing Single Sign-On (SSO), check that the page's web address/URL begins with https://login.cmu.edu/

CMU andrew account login screen beginning with https://login.cmu.edu

What if You Logged in to a Fake Login Page?

The following clues may indicate that you have logged in to a fraudulent page:

  • After you log in, you see a login page again instead of being taken to the page or service you were expecting.
  • After you log in, you see a document or page that is not what you were expecting

If you think you may have been a victim of this phishing scam, do the following to minimize potential damage to your personal information and Andrew account:

  • Change your Andrew Account password immediately from another computer at https://identity.andrew.cmu.edu/
  • Report the incident to the Information Security Office so your account can be analyzed for signs of compromise.