Wait, That Was a Test!
You clicked a simulated phishing link as part of our ongoing Email Security Awareness Program. Let us learn how to spot these in the future.
Do not worry! This was only a simulation. Nothing bad happened and you do not need to change your password. We are here to help you learn.
Let Us Break Down This Fake Invoice & Adobe Document Scam
From: CFO <lm@essrnannrules.net>
Subject: [External] Receipt of the missing invoices #156629 and #96953
| |
External Email: This email was sent from outside VIU. Treat links and attachments with extra caution. |
Red Flag #1: External Email Banner & Executive Impersonation
The "External Email" warning banner is your first critical clue. While the sender display name was set to "CFO" and signed off as executive leadership, the actual sending address was lm[at]essrnannrules[.]net. Legitimate communications from VIU senior leadership and financial administration always originate from internal @viu.ca addresses, never an unknown external domain.
"Please confirm receipt of the missing invoices for the attached new POs: #156629 and #96953."
"I look forward to your prompt reply."
Red Flag #2: Urgency Around Missing Invoices & Purchase Orders
Phishing attacks routinely manufacture a sense of urgency involving overdue invoices, missing purchase orders, or payment delays. Attackers use this psychological pressure to rush recipients into opening attachments before taking a moment to evaluate the message critically.
Alternate Signing Method Security Code:
A2A4AB5E6E004BA3A2556CA058110B387
"Please copy the code that appears in Acrobat to access the document..."
Red Flag #3: The Fake "Acrobat Security Code" Illusion
The email claimed you must "copy the code that appears in Acrobat to access the document", and the attachment displayed a long fake key. Authentic PDF viewers and institutional document systems do not require you to copy random alphanumeric strings out of an attachment to view an invoice. Attackers include these codes solely to mimic legitimate encryption services.
You have received a confidential document.
VIEW DOCUMENT WITH ADOBE
Actual Link Destination: hXXps://www[.]financerts[.]org (External Simulation Domain)
Red Flag #4: Impersonated Adobe Branding & Links Inside Attachments
Attackers may deliberately place malicious links inside attachments (such as HTML or PDF files) to evade automated security filters. Clicking "VIEW DOCUMENT WITH ADOBE" redirected to an external website (financerts[.]org) rather than a secure VIU or Adobe domain. Look closely at the fine print as well: phishing templates frequently contain subtle typographical errors, such as "Whether you're in an oce, at home..." instead of "office".
What Is the Number One Thing I Could Do?
The number one thing you can do is treat your Inbox like a school zone: Slow down when reading and acting on unexpected emails.
We are all super busy, juggling deadlines, and often working on autopilot. Attackers specifically count on distraction and urgency to get people to click. Taking just 5 seconds to pause, check the sender domain, and verify an unexpected invoice or financial document will stop almost every attack.
Email remains the single most common path attackers use to gain unauthorized access to institutional accounts and sensitive financial data.
What Should You Do Next Time?
Key Tips for Spotting Invoice and Document Delivery Scams:
- Check the real sender address: Look beyond the display name. If an email claims to be internal or from university leadership, make sure the actual address ends in
@viu.ca.
- Be cautious with unexpected attachments: Never open attachments or click document links for invoices or PO numbers you were not anticipating.
- Beware of fake access codes: Random security codes, PINs, or instructions to copy codes from attachments are red flags.
- Inspect link destinations: Check the web address in your browser before entering credentials or interacting with document portals.
- Verify through official channels: If in doubt about an invoice or payment request, contact VIU Finance/Procurement or the purported sender through known internal channels.
- Report suspicious messages: Use the Report Phishing button in Outlook to flag suspicious emails directly to the InfoSec team.
- When in doubt, contact IT: We are always happy to check an email for you!