Ms. Baker said checking with supervisors in person to follow up on unusual email requests; hovering over emailed links to make sure they connect to legitimate websites; and using common sense about whether the person who appears to be sending the email would request information such as login credentials are the first steps toward steering clear of cybercriminals.