Phishers often try to create a sense of urgency to get people to click the link in haste, and that tactic is on full display in this fake HR email. If you receive an email that claims to be from HR, especially one that seems urgent or feels intimidating, first take a few deep breaths, and then look closely at the email to see if there are signs that it’s fake. This one has quite a few red flags:
- The email did not come from UVic (in fact, the phisher appears to be abusing a compromised account at another university). A real UVic HR email would come from a UVic email address.
- The email was sent to hundreds of people, many of whom were not from UVic. That is a strong sign that this is a non-targeted mass phishing email and not a genuine HR notification.
- The greeting is impersonal, there is no signature block, and the email doesn’t specifically mention UVic.
- Hovering over the link will reveal that it does not go to a page from UVic; it actually goes to a page from a free online form builder.
From: [redacted]@********t.edu
To: [redacted] + 397 more
Subject: October 2024 Staff Report and Individual AssessmentYou don’t often get email from [redacted]@********t.edu. Learn why this is important.
Assessment Dear Team,
I am pleased to inform you that the HR Department has recently finalized the Staff Report for October 2024. It is imperative that you treat this matter with urgency.Attached below, you will find the relevant file that contains your individual Assessment Report. Please open it to access the information
Click Here [link] To View Report
Thank you for your prompt attention to this matter.