Everyone using the internet is at risk of receiving spam or phishing emails. Whenever you receive email messages, you should always consider whether they are legitimate. Even if they seem plausible, if you have any doubts, take a closer look and be aware of any warning signs. If anything looks suspicious, do not open attachments or reply to the message. Often these messages include links that lead to page where a user would give away their credentials or other sensitive data by filling out a form that often looks quite bona fide. Fake emails are called "phishing" emails. When you put your information into those forms, it is said you have been "phished."
Consequences of getting phished can include any of the following, and more:
your account gets locked out because your email account is used to send out large quantities of spam to other people
your sensitive data is used to steal your identity and set up e.g. credit cards in your name
Primary ways you can avoid getting phished
use a spam filter
be vigilant
hover over links in emails before you click to make sure you're going where you think you are
copy addresses and paste them into the address bar instead of clicking on links in emails
watch for obvious spelling/grammatical mistakes in otherwise official-looking emails
ask a known real person from the source organization if an email is actually genuine
most UWaterloo sites/logins require you to use Two-factor authentication (2FA). Consider enrolling in 2FA in non-University of Waterloo sites that you use.
How to report a phishing email
Forward the suspicious email as an attachment to soc@uwaterloo.ca, with the internet headers in the body of the email. More information can be found in this article How to forward an email as an attachment
Related articles
Need Help?
Contact the IST Service Desk online or 519-888-4567 ext. 44357.
Article feedback
If you’d like to share any feedback about this article, please let us know.