Cybersecurity often begins with one simple thing: your password. While it may seem like a small detail, passwords remain one of the primary ways attackers gain access to accounts, personal information, and sensitive data. Using strong, unique passwords or passphrases and storing them in a password manager is one of the most effective steps you can take to protect yourself online.

Why Passwords Still Matter

Many cyberattacks begin with compromised credentials. Attackers obtain passwords through phishing emails, data breaches, password guessing, malware, or by exploiting the common habit of reusing passwords across multiple accounts.

Once a password is compromised, attackers may attempt to use it on email, banking, social media, shopping, and workplace accounts. This technique, known as credential stuffing, can allow a single stolen password to unlock multiple services.

The good news is that strong password practices can significantly reduce this risk.

Common Password Mistakes

Many people unknowingly create passwords that are easy for attackers to guess, such as:

• Using names, pets, birthdays, or favourite sports teams.
• Reusing the same password across multiple accounts.
• Making only minor changes when updating passwords (for example, Summer2025! becoming Summer2026!).
• Storing passwords in unsecured spreadsheets, notebooks, or web browsers.

Attackers frequently use publicly available information, including social media posts, hobbies, family names, locations, and previous data breaches, to help guess passwords.

Creating Strong Passwords with Passphrases

Instead of trying to remember complex strings of random characters, consider using a passphrase. A passphrase is a series of unrelated words combined into a longer phrase, such as:

PurpleCoffeeRiverPianoWinter

Passphrases are easier to remember, harder for attackers to guess, and usually much longer than traditional passwords.

Why You Need a Password Manager

The biggest challenge with strong passwords is remembering them, think about how many different accounts you use every single day and how difficult it would be to remember all of those unique passwords. That's where password managers can help.

A password manager securely stores your passwords in an encrypted vault and can generate unique, complex passwords for each account. Instead of remembering dozens of passwords, you only need to remember one strong master password.

Benefits of password managers include:

• Generating strong, unique passwords automatically
• Securely storing passwords, passkeys, and other sensitive information
• Auto-filling credentials on trusted websites
• Reducing password reuse
• Alerting you when a password may be weak or compromised

91��ɫ has deployed 1Password as our enterprise-grade password management solution to help our community safeguard their credentials.

The Rise of Passkeys

As technology evolves, many organizations are beginning to adopt passkeys, a newer authentication method designed to be more secure and resistant to phishing attacks.

Unlike traditional passwords, passkeys use cryptographic authentication tied to your device and often protected by biometrics such as a fingerprint or facial recognition. This makes them significantly more difficult for attackers to steal or reuse.

When available, consider enabling passkeys on supported services as an additional layer of protection.

5 Password Safety Tips

1. Use a unique password for every account.
2. Create long passphrases instead of short passwords.
3. Store passwords in a trusted password manager.
4. Enable multi-factor authentication (MFA) wherever possible.
5. Never share passwords through email, text messages, or instant messaging platforms.

Your Passwords Are the Front Door

Think of your passwords as the keys to your digital life. Email accounts, banking information, cloud storage, social media, academic resources, and workplace systems all rely on them for protection.

By creating strong passphrases, using a password manager, and adopting modern security features such as MFA and passkeys, you can build a stronger defence against cyber threats and make it much harder for attackers to gain access to your accounts.

The post Your First Line of Defence: Password Security Essentials appeared first on Information Security.

While the scam primarily targets personal banking accounts, it affects the broader post-secondary community, including students, parents, guardians, faculty, and staff. Fraudsters are exploiting trust in financial institutions and creating a false sense of urgency to pressure victims into approving transactions themselves. In several cases, banks refused to refund the money because the customer approved the charges during the call, even though they were tricked.

How the scam works:

1. You get a call that shows your bank’s real phone number on caller ID.
2. The caller says there is fraud on your account and asks you to open your banking app, or read back a code sent by text, to “stop” the charges.
3. You are actually approving payments to a school you have no connection to.
4. The criminals have already collected money from international students by offering them “discounted” tuition. Your card is used to pay that tuition.

Warning Signs:

• Requests to use your personal credit card or bank account to assist another person's tuition payment.
• An unexpected call claiming to be from your bank's fraud department.
• Pressure to act immediately to "stop" suspicious transactions.
• Requests to approve banking app notifications while on the phone.
• Requests to provide one-time passcodes or verification codes received by text or email.
• A caller who insists you remain on the line while reviewing your banking account.
• Offers to pay tuition on someone's behalf at a discount or through an unofficial arrangement.

Remember, Caller ID can be spoofed and should NOT be trusted as proof of identity.

If you think you've been targeted:

1. Contact your bank or credit card provider immediately.
2. Request that your cards be blocked or replaced if necessary.
3. Ask your financial institution to investigate the transactions and initiate any available dispute or chargeback process.
4. Report the incident to your local police service.
5. File a report with the Canadian Anti-Fraud Centre at .
6. Keep records of all communications, case numbers, statements, and correspondence.

Criminals no longer rely solely on stealing passwords. Increasingly, they manipulate victims into approving transactions themselves. Taking a moment to verify who you are speaking with and independently contacting your bank can prevent significant financial loss.

Stay vigilant and help raise awareness by sharing this information with family members, especially students and parents who may be involved in managing tuition payments.

Questions or Concerns?

Reach out to 91��ɫ's Information Security Team by emailing infosec@yorku.ca.

The post Growing Tuition Payment Scam Targets Canadians Through Fake Bank Fraud Calls appeared first on Information Security.

The email described above is NOT legitimate and was NOT sent by 91��ɫ. If you clicked on the link and sent an email to utgsu.duo@aol.com, please change your password immediately. If you have re-used the compromised password on any other accounts, please change the passwords for those accounts to something complex and unique to each account. Passport 91��ɫ passwords can be changed at , logging in, clicking on “Passport YORK” on the left-hand menu and clicking the “Change My Password” button on the right.

Red Flags to Watch Out For:

1. Suspicious sender email: The sender's email address is randomly generated and not associated with 91��ɫ’s official IT services.
2. Request for personal details: 91��ɫ would NEVER ask for passwords, Duo/MFA passcodes, or other sensitive information via email.

What to Do:

• Do not respond to this email or provide any personal information.
• Do not click any links or open attachments that may be included.
• Report the email: If you received this phishing attempt, please report it using the  or forward it to phishing@yorku.ca

The post Phish Alert - 91��ɫu Account Verification Needed appeared first on Information Security.

October is Cybersecurity Awareness Month!

Throughout the month, the Information Security team will be sharing weekly cyber-focused themes, helpful resources, and interactive activities, all posted on our dedicated Cybersecurity Awareness Month page.

Be sure to check in each week for new content to keep you informed, engaged, and up to date on 91��ɫ’s latest cybersecurity initiatives.

The post Cybersecurity Awareness Month - October 2025 appeared first on Information Security.

Please note that 91��ɫ will NEVER request for passwords, Duo passcodes or other personal information via email or Google Form. 

Below is the latest job scam email that was sent to various mailboxes. 

The Information Security team has taken action to remove the fraudulent messages. If you receive similar messages, please report it immediately by clicking on the Report Phishing button or forward it to phishing@yorku.ca.

If you have already responded to this scam:

• Stop all communication with the scammer and notify infosec@yorku.ca;
• If you provided any account names or passwords, change any such passwords immediately;
• Be vigilant about reviewing any email correspondence from coinbase_coordinator@outlook.com;
• If you receive a Duo 2FA request that you do not expect, press NO and report it;
• Report the scam to your local law enforcement;
• Report the incident to the 

The post Job Scam Alert - Open Job Position appeared first on Information Security.

Scammers are using compromised 91��ɫU accounts to send fake job scam offering $550 or $650 USD weekly as a "91��ɫU Personal Assistant" OR "Remote Personal Assistant" OR "Virtual Assistant Needed" OR "PA - Team Assistant".

Following through with the fraudulent employment offer will result in compromised of personal information and potential financial loss.

An illustration of one of phishing pages is shown below:

The Information Security team has taken action to remove the fraudulent messages. If you receive similar messages, please report it immediately by clicking on the Report Phishing button or forward it to phishing@yorku.ca.

If you have already responded to this scam:

• Stop all communication with the scammer and notify infosec@yorku.ca;
• If you provided any account names or passwords, change any such passwords immediately;
• Be vigilant about reviewing any email correspondence from coinbase_coordinator@outlook.com;
• If you receive a Duo 2FA request that you do not expect, press NO and report it;
• Report the scam to your local law enforcement;
• Report the incident to the 

The post Job Scam Alert - "91��ɫU Personal Assistant" OR "Remote Personal Assistant" OR "Virtual Assistant Needed" OR "PA - Team Assistant" appeared first on Information Security.

A new job email scam, sent from a compromised 91��ɫ account, was reported by the community. Students are the main target of the FAKE job offer. The email asks prospective applicants to provide their Full Name, Cell number and personal email address.

The Information Security team has taken action to remove the fraudulent messages. If you receive similar messages, please report it immediately by clicking on the Report Phishing button or forward it to phishing@yorku.ca.

If you have already responded to this scam:

• Stop all communication with the scammer and notify infosec@yorku.ca;
• If you provided any account names or passwords, change any such passwords immediately;
• Be vigilant about reviewing any email correspondence from coinbase_coordinator@outlook.com;
• If you receive a Duo 2FA request that you do not expect, press NO and report it;
• Report the scam to your local law enforcement;
• Report the incident to the 

The post Job Scam Alert - Work opportunity for YORKU Students appeared first on Information Security.

Here is another fake job scam that has been circulating today.

Scammers are using compromised 91��ɫU accounts to send fake job scam offering an Executive Assistant/Administrative Assistant role.

Following through with the fraudulent employment offer will result in compromised of personal information and potential financial loss.

The Information Security team has taken action to remove the fraudulent messages. If you receive similar messages, please report it immediately by clicking on the Report Phishing button or forward it to phishing@yorku.ca.

If you have already responded to this scam:

• Stop all communication with the scammer and notify infosec@yorku.ca;
• If you provided any account names or passwords, change any such passwords immediately;
• Be vigilant about reviewing any emails sent to the email addresses you provided in the Google Form;
• If you receive a Duo 2FA request that you do not expect, press NO and report it;
• Report the scam to your local law enforcement;
• Report the incident to the 

The post Job Scam Alert - Executive Assistant/Administrative Assistant !!! appeared first on Information Security.

Scammers are using compromised 91��ɫU accounts to send fictitious job offers. The latest FAKE offer is looking for a Data Entry Clerk & Bookkeeper. Following through with the fraudulent employment offer will result in compromised of personal information and potential financial loss.

The Information Security team has taken action to remove the fraudulent messages. If you receive similar messages, please report it immediately by clicking on the Report Phishing button or forward it to phishing@yorku.ca.

If you have already responded to this scam:

• Stop all communication with the scammer and notify infosec@yorku.ca;
• If you provided any account names or passwords, change any such passwords immediately;
• Be vigilant about reviewing any emails sent to the email addresses you provided in the Google Form;
• If you receive a Duo 2FA request that you do not expect, press NO and report it;
• Report the scam to your local law enforcement;
• Report the incident to the 

The post Job Scam Alert - Data Entry Clerk appeared first on Information Security.

Scammers are using compromised 91��ɫU accounts to send fake job scam offering $350 for every COINBASE task performed.

Following through with the fraudulent employment offer will result in compromised of personal information and potential financial loss.

The Information Security team has taken action to remove the fraudulent messages. If you receive similar messages, please report it immediately by clicking on the Report Phishing button or forward it to phishing@yorku.ca.

If you have already responded to this scam:

• Stop all communication with the scammer and notify infosec@yorku.ca;
• If you provided any account names or passwords, change any such passwords immediately;
• Be vigilant about reviewing any email correspondence from coinbase_coordinator@outlook.com;
• If you receive a Duo 2FA request that you do not expect, press NO and report it;
• Report the scam to your local law enforcement;
• Report the incident to the 

The post Job Scam Alert - Coinbase Job Opening appeared first on Information Security.

Scammers are using compromised 91��ɫU accounts to send fake job scam offering an Executive Assistant/Administrative Assistant role.

Following through with the fraudulent employment offer will result in compromised of personal information and potential financial loss.

The Information Security team has taken action to remove the fraudulent messages. If you receive similar messages, please report it immediately by clicking on the Report Phishing button or forward it to phishing@yorku.ca.

If you have already responded to this scam:

• Stop all communication with the scammer and notify infosec@yorku.ca;
• If you provided any account names or passwords, change any such passwords immediately;
• Be vigilant about reviewing any emails sent to the email addresses you provided in the Google Form;
• If you receive a Duo 2FA request that you do not expect, press NO and report it;
• Report the scam to your local law enforcement;
• Report the incident to the 

The post Job Scam Alert - Executive Assistant / Administrative Assistant !!! appeared first on Information Security.

A confirmed phishing email with the subject line "Please Verify Your 91��ɫu Account" was sent to a number of mailboxes. Clicking on the provided link will redirect users to an external site hosted on forms.zohopublic.com.

If you clicked on the link and provided your credentials, please consider your account as compromised. Change your password IMMEDIATELY and notify us by sending an email to askit@yorku.ca.

NEVER authorize a 2-FA request that you did not initiate.

The post Phish Alert - Please Verify Your 91��ɫu Account appeared first on Information Security.

A scammer is using compromised 91��ɫU email accounts to send out job scam emails claiming to offer a personal assistant position at Flora Inc. Please note that this offer is fake.

Following through with the fraudulent employment offer will result in compromised of personal information and potential financial loss.

The Information Security team has taken action to remove the fraudulent messages. If you receive similar messages, please report it immediately by clicking on the Report Phishing button or forward it to phishing@yorku.ca.

If you have already responded to this scam:

• Stop all communication with the scammer and notify infosec@yorku.ca;
• If you provided any account names or passwords, change any such passwords immediately;
• Be vigilant about reviewing any emails sent to the email addresses you provided in the Google Form;
• If you receive a Duo 2FA request that you do not expect, press NO and report it;
• Report the scam to your local law enforcement;
• Report the incident to the 

The post Job scam Alert - Personal Assistant Position appeared first on Information Security.

A Phish email with the subject line "IT Notice - My Maintenance" was recently spotted. Clicking on the provided link will redirect users to an external site.

The email is a scam. Do not click on any links or provide any information.

If you clicked on the link and provided your credentials, please consider your account as compromised. Change you password IMMEDIATELY and notify us by sending an email to askit@yorku.ca.

NEVER authorize a 2FA request that you did not initiate.

The post Phish Alert - IT Notice - My Maintenance appeared first on Information Security.

There is an ongoing phishing campaign targeting students at 91��ɫ as well as other Canadian universities with a fake research job promising good money for very little effort. These phishing emails use a technique called “spoofing” to appear as though emails were sent by a 91��ɫ professor- even though they were NOT- in an attempt to appear credible.

A sample of this type of phishing email is shown below:

The aim of this phishing campaign is to recruit “money mules” who will launder money on behalf of the scammers. Scammers who have compromised other victims’ bank accounts will send payments to a money mule’s personal bank account and request that the money mule use those funds to purchase gift cards or cryptocurrency for the scammers; mediums of payment that are difficult to trace.

The scam proceeds as follows:

1. Recipients deceived by the phishing email reply to the scammers with their contact information.
2. Scammers reply back, asking for additional personal information as part of the non-existent application process.
3. After recipients provide the requested information, the scammers claim that the recipient has been selected for the paid position.
4. Scammers provide money mules with a basic data entry task which is easily completed.
5. Scammers then ask money mules to deposit a cheque into their personal bank accounts, keep a portion of the funds, and purchase gift cards with the rest
6. If money mules follow through and provide the scammers with the gift card codes, the scammers have successfully laundered their stolen money. Scammers may continue sending cheques to the money mules to purchase more gift cards (variations of this scheme may also ask for cryptocurrency).
7. The money mule’s bank eventually flags the fraudulent transaction(s) and freezes the money mule’s bank account. The money mule may be held financially responsible for the fraudulent transaction(s) committed through their bank account.

Please exercise extreme caution when receiving emails that claim to be from a well-known or reputable person which offer well-paid, low-effort positions; this is “too good to be true”. Additional red flags include:

• Requests to switch correspondence to a different email address or application (Discord, WhatsApp, Signal)
• Requirements to use one’s personal bank account to complete tasks
• Requests to purchase gift cards or cryptocurrency as part of one’s work

The Canadian Anti-Fraud Centre has documented this type of scam: 

If you have received such an email, please do not reply to it or any email addresses it lists. If you suspect that you may have fallen for this phishing scam and either provided sensitive information to or performed actions for the scammers, please reach out to the Information Security team via infosec@yorku.ca.

The post Phishing Alert - Interdisciplinary Research Project/Aide Money Mule Scam appeared first on Information Security.