Phishing Campaigns – Tips to Stay Safe

Threat actors are targeting individuals who interact with the State Water Resources Control Board and Regional Water Quality Control Boards (Water Boards) by sending personalized phishing emails that impersonate the organization, using the Water Boards' official logo and publicly available information.

Examples of Fraudulent Emails

Fraudulant Email Example
Fraudulant Email Example #1

View Full-Size Image

Fraudulant Email Example #2
Fraudulant Email Example #2

View Full-Size Image

Fraudulant Email Example
Fraudulant Email Example #3

View Full-Size Image

Fraudulant Email Example
Fraudulant Email Example #4

View Full-Size Image

These malicious emails are designed to lure recipients into clicking a link that redirects to a fake website impersonating the Water Boards' official site, with the intent of harvesting credentials, such as username and password.

Use a trusted method to contact Water Boards by visiting the Water Boards' official website at www.waterboards.ca.gov, contacting your local Division of Drinking Water District Office, or, for California Water Accounting, Tracking, and Reporting (CalWATRS), emailing CalWATRS-Help@waterboards.ca.gov.

Protect Yourself

Use the following tips to better protect yourself from falling victim to phishing:

  • Carefully review the sending email address, not just the display name.
    • Hover over the sender's name to reveal the actual email address before opening attachments or clicking links.
  • Be cautious of messages that create a strong sense of urgency or pressure you to act immediately.
    • Examples - "If no response is received within 24 hours, your license will be revoked." or "Update your license now."
  • Do not click on links or open attachments in unexpected emails.
    • Fraudulent websites look similar to legitimate ones but contain slight variations or misspellings.

*With the widespread use of artificial intelligence (AI), phishing emails will now have correct grammar and spelling and will look more polished, so watch out for the other signs.

Report It

If you believe you have received a suspicious email claiming to be from Water Boards, do not respond or click any embedded links.

  • Report the email to the California Cybersecurity Integration Center (Cal-CSIC) by saving the phishing email as a .msg or .eml file and attaching that file to an email to calcsic.phishing@caloes.ca.gov.
  • File a complaint with the Internet Crime Complaint Center's website to report a cybercrime at www.ic3.gov.