Phishing Email Scam: Letters of Recommendation

Phishing Email Breakdown 

This phishing attempt impersonates an internal academic announcement about letters of recommendation, using familiar school-related language to appear credible. It prompts staff to click on a link labeled as an assessment report, which instead leads to a malicious form intended to capture login credentials and other sensitive information. 

Visual Example of the Phishing Email 

Full Text from the Phishing Attempt 

Attached is the internal 2025-2026 Extension directory in the Url Below 

Dear All Staff, 

With spring approaching, it’s time for juniors to request letters of recommendation. As admissions continue to be highly competitive, these letters carry significant weight, especially with reduced standardized testing. We greatly appreciate your time and effort in supporting our students. 

Please view your assessment reports here 

Thank you for your dedication and support across our universities and colleges. 

Sincerely 

How to Protect Yourself? 

1. Verify the Sender: Always verify the identity of individuals claiming to be someone important, especially if the message seems out of the ordinary and asks for personal information. 
2. Avoid Clicking on Suspicious Links: Hover over or copy the link to view the complete domain name. Scammers often create URLs that resemble authentic ones by inserting subtle misspellings or extra characters. If the link looks suspicious, it’s safer to visit the official website directly or use a reputable search engine to find the correct webpage. 
3. Check Branding, Formatting, and Logos Carefully: Phishing emails may imitate official layouts or use low-quality, off-colour logos. Verify that logos, colours, and the overall format matches what you typically see from the genuine organization. 

Important Notes: 

1. Report Suspicious Messages: Reporting phishing attempts helps prevent others from falling victim to these attacks. Send suspicious messages to is-spam@mcmaster.ca for review and investigation. 
2. Educate Yourself: Learn about common phishing tactics. Consider participating in the Information Security Training Program to protect against cyber threats and secure your digital world.