To gain access to secure university services and student accounts, Princeton students use a multi-factor authentication solution from Duo. In the past, users could opt to receive secure codes from Duo via text message or phone call, but these methods have been phased out.

An article in the Daily Princetonian cites an email from the university’s Office of Information (OIT) Technology saying that these older methods are now, “a common target for hackers looking to compromise accounts.”

Between 2022 and 2024, there was a 44% increase in unique phishing emails and a 186% rise in reported incidents.

In mid-June, the switch was made, and all users must now rely on one of two more secure methods.

OIT’s preferred method is the Duo Mobile app, which uses push notifications that require the account owner to verify that the login attempt is valid. Second, biometric authentication using Windows Hello; TouchID or FaceID on Macs and iPhones; and Android biometric options may be enabled.

Princeton is not the only campus to take this action. Some have already eliminated SMS and phone options in their Duo system, and others are in process of doing so.

Princeton also strengthens spam filtering

The rise in phishing attacks at Princeton prompted the institution to make changes to its spam filters and email delivery processes earlier in the year.

In the two years between 2022 and 2024, there was a 44% increase in unique phishing emails and a 186% rise in reported incidents.

In response, Princeton’s Information Security Office ratcheted up the threshold on its spam filters, making it harder for phishing emails to reach inboxes. They also began diverting more of these messages directly to the user’s trash folder, bypassing the junk folder altogether.

Analyzing phishing trends at Princeton

These phishing emails are often sophisticated and targeted to the student community. They promise research assistant positions or internships, include university logos, and appear to come from actual university leaders.

The Princetonian received data from OIT on phishing attacks dating back to 2021. Authors did an in-depth analysis, and the findings provide great insight.

Specific areas of analysis include:

• Year over year increase in phishing attempts
• Most frequent words used in subject lines
• Most common time of day for email delivery
• Number of attempts by day of week.

The trends at Princeton are likely pervasive throughout higher education, so the article is a must read for all campus administrators.