Phishing vs. Spam | UNC Asheville ITS

Phishing vs. Spam: Know the Difference

Not all annoying emails are dangerous. To keep our campus secure without overloading our security team, please use the Phish Alert Button only for malicious emails.

Feature	🎣 Phishing (Report This!)	🚫 Spam (Do NOT Report with PAB)
Intent	Malicious. Designed to steal your password, money, or identity, or to infect your device with malware.	Commercial/Annoying. Unsolicited junk mail, unwanted advertisements, or newsletters you never signed up for.
Common Tactics	Creates false urgency, demands immediate action, asks for credentials, or contains suspicious attachments/links.	Trying to sell you a product, service, or subscription.
Sender Identity	Often impersonates campus leadership (Deans, HR, IT) or known brands (Netflix, Amazon, Banks).	Usually from legitimate (but annoying) marketing companies or random vendors.
Action to Take	Click the Phish Alert Button.	Use Gmail’s standard "Report Spam" or "Block" option.

💡 Rule of Thumb: If an email is trying to trick, scam, or threaten you, it’s Phishing. If it’s just trying to sell you something or cluttering your inbox, it’s Spam.