You are now in the main content area

Phishing

With your help, TMU can minimize online threats.

Phishing emails are designed to deceive you into:

  • Clicking a link and entering personal details like your TMU username and password;
  • Giving away personal details like your credit card or bank account numbers; 
  • Opening an attachment and installing malicious software; or
  • Impersonating someone in an attempt to commit fraud with your help.

Each month, our university fields 1,500 increasingly convincing phishing emails attempting to target students, faculty and staff.

What to do with a phish

Step 1:
Keep yourself safe

Avoid clicking unverified links or opening unexpected attachments provided in emails.

Step 2:
Keep your community safe

Report a phish by forwarding it to spamrec@torontomu.ca.

How to catch a phish

Protect yourself by knowing how to recognize phishing attempts so you can report and delete them.

  • The sender's address is suspicious.
  • The "To" field is blank or for another person.
  • The email includes typos or grammatical errors.
  • The message contains an urgent request for personal information.
  • The message requires immediate action to avoid a problem like losing access to your TMU account.
  • When you hover over a link or button in the email, it directs you to an address (usually suspicious) unrelated to the text in the link.

Spear phishing is a phishing tactic that targets a specific person by sending fraudulent emails that include personal information about the victim, tricking them into believing the email is legitimate.

Learn tips for spotting spear phishing attacks.

Here is an example where the sender is pretending the email is from a TMU address, but the actual address is really from uniswa.szabc.

Sender is from: 'no-reply@torontomu.ca' but the actual address is really from 'pjmusi@uniswa.szabc'

Here is an example of an email that claims to be from FedEx where the actual address is from specweldfab.revitalsite.comabc.

Email that claims to be from 'FedEx International Ground' but the actual address is from 'richard.shepherd@specweldfab.revitalsite.com'abc

It’s always worth taking a moment to carefully check the full email address of the sender.

Here is part of an urgent request that included a link to a fake TMU login page:

Phishing email stating, 'Due to high numbers of inactive library accounts on our server, you are urged to validate your library account within a week after receiving this e-mail'

Here’s another example of an urgent request:

Urgent request 2: We would be shutting down several TORONTOMU MAIL Accounts. You will have to confirm your TORONTOMU MAIL Account. So you are required to provide us with the following information. Full Name: Username: Password: Telephone

Both of these fake messages include tell-tale grammatical errors and demand you take action to avoid losing access to your account.

Hackers can also target you by directing you to malicious phishing websites or contact you via your mobile devices.

How to report a phish

If you think you’ve received a phishing email:

Forward the email to spamrec@torontomu.ca using the “forward” function.

Delete the email from your mailbox without clicking on any links or attachments.

Tip: Avoid using the “Report phishing” option that’s built into the TMU Gmail platform. Forwarding the phish to spamrec@torontomu.ca ensures you’re reporting it directly to us so we can stop it from reaching others at the university.

How to reveal a true link

A crucial skill in defending against phishing is knowing how to check a link to reveal its true URL before clicking on it.

Links in phishing emails and on fake websites often don’t match what or who they claim to be. If a URL is unfamiliar or differs from what you expected, don’t click.

On a computer:

Hover your cursor over a link—the true URL will show at the bottom of your browser.

On a mobile device:

Press and hold the link (rather than tap) to preview the true address.