The Information Security team has detected a new phishing scam circulating among the York University community on August 26th, 2025. The email was sent from a compromised external email address using the subject line "Yorku Account Verification Needed", and prompts recipients to submit personal information to prevent account deactivation.
The email falsely states that your York account will be deactivated unless you submit sensitive information, including your Full Name, Cell Phone Number, Password, York Email/Username, and Duo passcodes to a fraudulent email address (utgsu.duo@aol.com).
Red Flags to Watch Out For:
- Suspicious sender email: The sender's email address [ezreal.xie@mail.utoronto.ca] is not associated with York University’s official IT services.
- Urgency and fear tactics: The email pressures you to act immediately by threatening account deactivation.
- Request for personal details: York University would NEVER ask for passwords, Duo/MFA passcodes, or other sensitive information via email.
- Unsecure email address for responses: The email asks you to respond to a suspicious AOL email address (utgsu.duo@aol.com), which is not a legitimate York University domain.
What to Do:
- Do not respond to this email or provide any personal information.
- Do not click any links or open attachments that may be included.
- Report the email: If you received this phishing attempt, please report it using the Report Phishing button or forward it to phishing@yorku.ca