Sometimes phishers send phish through OneDrive using compromised accounts, and other times they just create imitation OneDrive emails. This phish falls into the second category. Signs that this is not a real OneDrive file sharing notification include:
- The sender is not from UVic or Microsoft
- The “RECIPIENTS REAL DOMAIN LLC” banner is generic/placeholder content that wouldn’t be present on a real OneDrive email
- There are errors in spelling (e.g., “Adjusment” and “Automatated”) and capitalization
- Hovering over the link shows that it does not go to UVic or Microsoft
You don’t often get email from info@******centre.com. Learn why this is important.
RECIPIENTS REAL DOMAIN LLC
Uvic,
You have one New Document waiting on your OneDrive
Document Details
File:
5894 Adjusment to Fiscal Policies Q4.pdf
Size: 23.12kb
Date
September 01, 2025
Note:
You are required to review the shared document and advise accordingly[Button/link: View on OneDrive]
3584059-359-6-46-492-693-02035
This is an Automatated OneDrive Communication. Do not reply to this mailbox.