The Information Security team is aware of a phishing scam targeting International Students that is being circulated among the York community on September 22, 2025. The scam instructs students to provide sensitive information pertaining to their financial institution, passport, and tuition payment information. The scam uses the York University logo and is attempting to impersonate York University Vice-Provost Students to instill a false sense of legitimacy. This letter is NOT legitimate and was NOT sent by York University.
The scam letter is shown below for reference:
If you receive the scam letter via email or any other communication medium, please do NOT respond to the scammer and report it using the Report Phishing button or forward it to phishing@yorku.ca.
Red Flags to Watch Out For:
- Suspicious sender email: The sender's email address [i.e. example@mail.google.ca] is not associated with York University’s official IT services.
- Urgency and fear tactics: The email pressures you to act immediately by threatening account deactivation.
- Request for personal details: York University would NEVER ask for passwords, Duo/MFA passcodes, or other sensitive information via email.
- Unsecure email address for responses: The email may ask you to respond to a suspicious external email address (i.e. utgsu.duo@aol.com), which is not a legitimate York University domain.
If you have already responded to this scam, stop all communication with the scammer and notify infosec@yorku.ca; If you provided any account names or passwords, change any such passwords immediately.