Phishing Email Scam: McMaster Salary Notification

Phishing Email Breakdown 

This phishing email mimics an HR notification, falsely claiming a 16.89% salary increase effective June 30, 2025. It urges recipients to open a password-protected document to approve the salary increase, which redirects to a fake and malicious Microsoft login page designed to steal credentials. 

Visual Example of the Phishing Email 

Full Text from the Phishing Attempt 

Dear All, 

Sequel to last week notification, find enclosed here-under the letter summarizing your 16.89 percent salary increase starting 30 June 2025 

All documents are enclosed here-under: 

NOTE: Your Access is needed to go through the salary increment letter, Initial Access is {document password} 

Payroll & Employee Relations 

How to Protect Yourself? 

1. Verify the Sender: Always verify the identity of individuals claiming to be someone important, especially if the message seems out of the ordinary and asks for personal information. 
2. Avoid Clicking on Suspicious Links: Hover over or copy the link to view the complete domain name. Scammers often create URLs that resemble authentic ones by inserting subtle misspellings or extra characters. If the link looks suspicious, it’s safer to visit the official website directly or use a reputable search engine to find the correct webpage. 
3. Be Mindful of Generic Greetings: Phishing emails commonly start messages with “Dear User” or “Dear Sir/Madam” rather than using your real name. Legitimate messages typically include your actual name or specific account details. 
4. Check Branding, Formatting, and Logos Carefully: Phishing emails may imitate official layouts or use low-quality, off-colour logos. Verify that logos, colours, and the overall format matches what you typically see from the genuine organization. 

Important Notes: 

1. Report Suspicious Messages: Reporting phishing attempts helps prevent others from falling victim to these attacks. Send suspicious messages to is-spam@mcmaster.ca for review and investigation. 
2. Educate Yourself: Learn about common phishing tactics. Consider participating in the Information Security Training Program to protect against cyber threats and secure your digital world.