Phishing Email Scam: Member Invitation Confirmation

Phishing Email Breakdown 

This phishing attempt mimics a legitimate team management notification, falsely stating that a new administrator has been added to a user’s team account. It exploits urgency and fears of unauthorized access to lure recipients into clicking a link to the management portal, which instead leads to a phishing site. 

Visual Example of the Phishing Email 

Full Text from the Phishing Attempt 

Team Member Invitation Confirmation 

Dear User, 

This automated message confirms that a new user has been invited to your team account. The invited user’s email address is: {email address} 

Please note that this user has been provisioned with administrator privileges upon invitation. This access level grants comprehensive control over your team’s account settings, user management, and data. We recommend reviewing assigned permissions to ensure they align with your organizational policy. 

You can manage all active team invitations, review current user roles, and adjust permissions at any time through your dedicated administration portal. 

Access User Management Portal

How to Protect Yourself? 

1. Verify the Sender: Always verify the identity of individuals claiming to be someone important, especially if the message seems out of the ordinary and asks for personal information. 
2. Watch Out for Emotional Triggers: Phishing emails often use fear, sympathy, or urgency (e.g., “Your account will be closed immediately!”) to push users into acting without thinking. Pause, reevaluate the request, and confirm its legitimacy before responding. 
3. Be Mindful of Generic Greetings: Phishing emails commonly start messages with “Dear User” or “Dear Sir/Madam” rather than using your real name. Legitimate messages typically include your actual name or specific account details. 

Important Notes: 

1. Report Suspicious Messages: Reporting phishing attempts helps prevent others from falling victim to these attacks. Send suspicious messages to is-spam@mcmaster.ca for review and investigation. 
2. Educate Yourself: Learn about common phishing tactics. Consider participating in the Information Security Training Program to protect against cyber threats and secure your digital world.