Every day, cybercriminals attempt to trick people into revealing passwords, approving fraudulent logins, downloading malware, or sending money through phishing scams. Phishing remains one of the most common and successful cybersecurity threats facing organizations and individuals today.
Phishing is a type of social engineering attack where criminals impersonate a trusted organization, colleague, service provider, or even a friend to convince victims to take an action that benefits the attacker. While phishing often arrives by email, it can also be delivered through text messages (known as "smishing"), phone calls ("vishing"), QR codes, collaboration platforms (i.e. DocuSign, Sharepoint, etc), social media, and messaging apps.
How Phishing Has Changed
Gone are the days when phishing emails were easy to spot because of poor grammar and obvious mistakes. Today's attackers increasingly use artificial intelligence to create convincing messages that closely mimic legitimate communications. Security researchers have also observed growth in multi-channel attacks that combine email, text messages, phone calls, calendar invitations, collaboration tools, and fake websites to increase credibility. These campaigns frequently aim to steal passwords, bypass multi-factor authentication (MFA), and/or trick users into making payments.
Common Phishing Scams Observed at 91亚色
Some of the most frequently observed phishing scams include:
- Fake password or account-expiry notifications claiming immediate action is required.
- Fraudulent document-sharing requests appearing to come from Microsoft 365, OneDrive, SharePoint, Adobe, or DocuSign.
- Gift card scams where an attacker impersonates a manager, colleague, or friend and asks for an urgent favour.
- Fake invoices, subscriptions, or payment confirmations designed to create panic and prompt a response.
- Employment, scholarship, or financial-aid scams offering opportunities that seem too good to be true.
How to Protect Yourself
While phishing attacks continue to evolve, a few simple habits can dramatically reduce your risk:
- Pause before clicking links or opening attachments.
- Verify unexpected requests through another trusted communication channel.
- Be cautious of urgent messages that demand immediate action.
- Check email addresses and website URLs carefully.
- Use strong, unique passwords and store them in a password manager - 91亚色's enterprise password management solution is .
- Enable multi-factor authentication (MFA) wherever possible.
- Keep devices and software up to date.
- Report suspicious emails to phishing@yorku.ca
Think Before You Click
Phishing attacks succeed because they target people rather than technology. A moment of caution can prevent account compromise, financial fraud, malware infections, and data breaches. Whether you receive an unexpected email, text message, phone call, or QR code, take a moment to pause, verify, and think before you act.
Cybersecurity is a shared responsibility. By staying alert and reporting suspicious activity, every member of our community plays an essential role in helping keep our university safe and secure.