Phishing Email Scam: Tasks awaiting your completion at McMaster͏͏͏͏͏͏͏͏͏͏

Phishing Email Breakdown 

This phishing email uses a generic subject (“Tasks awaiting your completion at McMaster”) and creates a false sense of urgency by claiming that outstanding tasks require immediate action. It encourages the recipient to click the “View and complete tasks” button or copy and paste the provided link into their web browser. Following either redirects the recipient to a fake login portal designed to steal their McMaster credentials. 

Visual Example of the Phishing Email 

Full Text from the Phishing Attempt 

Tasks Pending For Ticket {ticket number} 

Hi {recipient email address}, 

This is an automated message. The following tasks are still showing as outstanding on system awaiting your approval. 

{task} 

View and complete tasks 

If the button above is not visible, copy and paste the following link in the browser: 

{link} 

Please do not reply to this automated email. 

Sincerely, 

HR Department 

How to Protect Yourself? 

1. Verify the Sender: Always verify the identity of individuals claiming to be someone important, especially if the message seems out of the ordinary and asks for personal information. 
2. Avoid Clicking on Suspicious Links: Hover over or copy the link to view the complete domain name. Scammers often create URLs that resemble authentic ones by inserting subtle misspellings or extra characters. If the link looks suspicious, it’s safer to visit the official website directly or use a reputable search engine to find the correct webpage. 
3. Check Branding, Formatting, and Logos Carefully: Phishing emails may imitate official layouts or use low-quality, off-colour logos. Verify that logos, colours, and the overall format matches what you typically see from the genuine organization. 

Important Notes: 

1. Report Suspicious Messages: Reporting phishing attempts helps prevent others from falling victim to these attacks. Send suspicious messages to is-spam@mcmaster.ca for review and investigation. 
2. Educate Yourself: Learn about common phishing tactics. Consider participating in the Information Security Training Program to protect against cyber threats and secure your digital world.