Game – Cyber Bowl @ UF

Question 1/5
You get a phone call from someone claiming to be from your school’s IT Help Desk, offering to follow up on a computer problem that you never asked them about. What do you do next?*
- Hang up the phone immediately
- Ask them for additional information
- Follow their instructions because I have been experiencing a problem with my computer
You recognize this is a common tactic of social engineers who want to gain access to your computer.
This is a common scheme used by social engineers to gain your trust and access your computer by providing you with fake instructions to “fix” your device.
Even if you have been experiencing a problem with your device, you should be skeptical of any unsolicited calls promising to fix it. This scenario is a common scheme social engineers use to gain your trust and access your computer by providing you with dangerous instructions purported to “fix” your device.

Question 2/5
You check your email to find your football tickets and see an email from a professor offering a $350/week position as a research participant—with only 10-hour work weeks! In response, you:*
- Ignore and delete the email immediately
- Respond to the email to indicate your interest
- Report this email using your school’s phishing reporting tool or designated email address
You find out the email was fraudulent, and IT freezes the professor’s stolen account, stopping the scammer.
You may have dodged a tackle, but you let the enemy run 20 yards and scam others by failing to report the fraudulent email.
You just gave your information to a social engineer. Emails offering incredible jobs are a common scam, and they are especially targeted toward college students.

Question 3/5
Your team just won the big game, and you got the game-winning play on video! You are eager to share it with your friends and family on social media, but when do you post it on your public profile?*
- Just after the game ends, so I don’t miss anything
- A few hours after the game ended
- Right away, before anyone else gets a chance to share it
You know that posting where you are in real-time is dangerous. Everyone is still buzzing about that amazing play hours later, and all your friends love the video!
Posting your location, especially on a public account, puts you at risk. Anyone, including those with malicious intentions, can use your posts to pinpoint where you are—or are not. Best to wait until you are somewhere else, or even better, at home.
Posting where you are in real-time, especially on a public account, puts you at risk. Anyone, including those with malicious intentions, can use your posts to pinpoint where you are—or are not. Best to wait until you are somewhere else, or even better, at home.

Question 4/5
You receive a text saying you won free tickets to your school's sold-out game! In response, you:*
- Use your messaging app’s “Report Junk/Phishing” feature or university’s designated reporting email address
- Let them know you will reach back out after you do some research
- Follow a link and fill out the requested information
You identified this message is from a social engineer, who is attempting to take your personal information. By reporting your message, you help improve spam filters—stopping this scammer and others.
This message came from a social engineer and is illegitimate no matter what “research” you conduct. Plus, by replying, you have notified the scammer that your phone number is valid—opening the door for future attempts to steal your information.
The message was from a social engineer trying to uncover your personal information. By filling out the form, you handed it right over and did not receive the promised free tickets!

Question 5/5
While you are out for lunch, you get several notifications saying you are trying to log in to your university email via the multi-factor authentication (MFA) app on your phone. You:*
- Decline the push and reset your password via your school’s account portal
- Ignore the push since you are not actively logging in
- Accept the push, it was probably a mistake
You recognize the push request was initiated by an attacker who stole the password to your school login. By resetting your password, the attacker can no longer send you MFA requests, and your account is secured. It is also recommended that you report the push as fraudulent so your university can work to remove the hacker!
The push request was initiated by an attacker who stole the password to your school login. They continue to send more push requests, hoping you will break down and accept one of them—at which point they will have access to your account.
The push request was initiated by an attacker who stole the password to your school login. By accepting the request, you just allowed them into your account!
Name
This field is for validation purposes and should be left unchanged.

It’s game time!