How to Spot and Report a Phishing or Suspicious Email

October is Cyber Security Awareness Month in Canada. Phishing remains one of the most common ways attackers attempt to compromise accounts, steal credentials and gain access to university data.

Following the Government of Canada Get Cyber Safe guidelines, Vancouver Island University (VIU) encourages all students, faculty and staff to review the seven red flags of phishing. Recognizing these warning signs helps keep our entire community secure.

The Seven Red Flags of Phishing

Evaluate incoming messages for these common warning signs:

1. Urgent or threatening language
   The email attempts to create a false sense of urgency or fear. It may threaten account suspension, missed deadlines, legal action or financial penalties if you do not respond immediately.
2. Requests for sensitive information
   The message asks you to provide sensitive data through email or an unverified link. This includes passwords, 2-Step Verification (2SV) codes, credit card numbers or Social Insurance Numbers.
3. Too good to be true
   The message promises unexpected rewards, lottery winnings, gift cards, tax refunds or lucrative work-from-home job offers with minimal effort.
4. Unexpected communications
   You receive unrequested invoices, package delivery tracking notifications, wire transfer requests or shared document links that you were not expecting.
5. Information mismatches and suspicious senders
   The sender display name may show a recognized person or department, but the underlying email address is unfamiliar or external. Additionally, when you hover your cursor over links, verify that the actual destination URL matches the displayed text and does not lead away from official viu.ca domains.
6. Suspicious attachments
   The email includes attachments that you did not request, especially file types commonly used to deliver malware (such as .zip, .html, .exe or macro-enabled Office files).
7. Unprofessional layout or strange branding
   The email displays low-resolution logos, broken layouts, distorted graphics, awkward phrasing or generic greetings such as "Dear User" instead of your name.

What to Do If You Receive a Suspicious Email

If you encounter an email that displays any of these red flags, take the following precautions:

• Do not click links: Hover over links to inspect the destination URL, but do not click them.
• Do not open attachments: Unexpected files can infect your device with malware or ransomware.
• Do not reply: Never reply or attempt to contact the sender using details in the email.
• Do not simply delete it: Reporting the email is crucial. It allows the IT Security team to analyze the threat and proactively pull the malicious message from other VIU inboxes.
• Do not forward to colleagues: Report the message directly so the IT Security team can take university-wide action.

How to Report Phishing in Outlook

Reporting suspicious emails allows the VIU IT Security team to analyze the threat and block malicious senders for everyone at VIU.

Outlook Desktop and Outlook on the Web

1. Select the suspicious email in your inbox.
2. In the top Ribbon or message actions menu, click Report Message (or Report).

   

3. Select Phishing from the drop-down menu.
4. Click Report in the confirmation prompt.

Outlook automatically moves the email to your Deleted Items folder and sends a copy to the VIU IT Security team for investigation.

Outlook Mobile (iOS and Android)

1. Open the suspicious message in the Outlook mobile app.
2. Tap More actions (the three dots ...) in the top-right corner of the message.
3. Tap Report Junk and select Report Phishing.

What to Do If You Interacted with a Suspicious Email

If you clicked a link, downloaded an attachment or entered your VIU credentials:

1. Change your password immediately: Follow the VIU password reset guide from a secure device.
2. Deny unexpected 2SV prompts: If you receive an unexpected 2-Step Verification prompt on your mobile device, select Deny immediately.
3. Contact the IT Helpdesk: Call 250.740.6300 (toll-free: 1.833.902.6301) right away to report the compromise and have your account secured.

External Resources

• Get Cyber Safe: The 7 Red Flags of Phishing (Government of Canada)
• Download the 7 Red Flags Printable Poster (Get Cyber Safe)