AVÌìÌÃ

Payroll/direct deposit scam

Direct deposit scams use emails to trick someone into changing their direct deposit information or entering their banking information on a fraudulent page. The scammers then reroute deposits or transfer money to their own accounts.

These scams often target UVic students and employees.

How it works

Scammers impersonate payroll, HR or financial aid staff and send emails that look official.

The emails may:

• include urgent messages or threats
• mimic UVic's (or another company's) branding and email format
• ask you to go to a web page and confirm your data with your username and passphrase

Scammers also often impersonate the Canada Revenue Agency (CRA) for these scams, especially during tax season (mid February to mid June). .

Example of the scam

Many UVic students received this message in August 2023:

How to avoid these scams

• Don't give out credentials: Never give out your credentials, such as bank details, in response to an email.
• Use UVic Online tools: Instead of following email links, use UVic's Online tools to find your personal and financial records.
• Report suspicious emails: Report the email using Outlook's Report tool.
  • The information security office will investigate and block the sender from targeting other people.
• Inform IT and HR: Forward all suspicious emails to your IT or HR representative.
• Use multi-factor authentication: Use multi-factor authentication (MFA) to verify your identity.
• Set up internal alerts: Set up internal alerts for any changes in your bank account details.

Gift card scam

Gift card email scams trick someone into buying gift cards for the scammers. The scammers will impersonate someone that you know. They will create a sense of false urgency and use other common social engineering tactics to engage with targets.

These scams often target UVic employees.

How it works

Gift card scams usually:

• impersonate someone in a leadership or management position
  • often not the target's direct supervisor, but the office of a president, vice president, dean or chair that the target might not have much direct contact with
• start with a short (1 or 2 line) question or request, often asking if you have time to do a task or favour for them
• start with email, but may ask for a phone number so they can also send fraudulent voice or text messages
• ask you to buy gift cards from a physical store and send them the serial number or a photo of the bar code from the cards

Example of the scam

A scammer impersonating a real UVic professor sent these emails in late 2023:

How to avoid these scams

• Don't respond: Don't reply to the sender of the email.
• Report suspicious emails: Report the email using Outlook's Report tool.
  • The information security office will investigate and block the sender from targeting other people.
• Report the incident: Report the incident to the site where the fraudster first contacted you.  
• Close compromised accounts: Contact your bank or financial institution to close or update information related to any compromised accounts.
• Save information: Save all information or messages about the individual(s) who contacted you 

Job scam

Job scam emails will offer you a fake job with the intent of tricking you into giving personal information like bank details, sending the scammers money or doing labour for free.

These scams often impersonate UVic employees. They target UVic students and employees.

How it works

Scammers construct a realistic online presence to help sell the scam. They create fake company websites or clone real ones and create fake banks with websites. They also create official looking employment documents like offer forms, tax forms, personal information forms and banking deposit information forms. 

Example of the scam

A scammer impersonating a real UVic professor sent these emails in February 2024:

How to avoid these scams

Watch out for these warning signs:

• You did not apply for the job. Real organizations do not send random emails about jobs.

• They say you can make a lot of money for little work. If it sounds too good to be true, it probably is.

• They want you to buy gift cards, cash cheques or send money.

• They ask you to text them or use a non-UVic email.

• They ask for your personal information, such as your SIN, photo ID or bank details, before they give you a formal offer.

• They sound urgent or pushy and want you to act fast. They’re trying to pressure you into making a bad decision. Don’t fall for it. Take your time and think it through.

• The email is from a Gmail, Yahoo or Outlook address. Real companies should use their own email domains.

Examples from the Phish Bowl

• (October 2024)

Email access scam

Email access scams impersonate businesses and tell you that your email account will be (or has been) disabled or deleted unless you take action. The instructions they give you to recover your account will give the scammers your personal information.

These scams exploit the fear of losing access to important accounts or services to trick you into divulging sensitive information, usually your username and passphrase.

These scams often target UVic students and employees.

How it works

• These emails typically claim that your account has been suspended due to suspicious activity or a violation of terms and conditions.
• The scammers then prompt you to click on a link or provide personal information to resolve the alleged issue. 
• These phishing emails often mimic the branding and design of UVic or well-known tech companies. They sometimes claim to be from UVic's IT department or another department that works with employee or student records. They sometimes use the UVic wordmark.

Example of the scam

UVic students received this email in March 2024:

How to avoid these scams

• Change your passwords: If you have provided your credentials, change your passwords for all affected accounts immediately.
• Set up multi-factor authentication: Use multi-factor authentication (MFA) to verify your identity.
• Report suspicious emails: Report the email using Outlook's Report tool.
  • The information security office will investigate and block the sender from targeting other people.
  
  

Giveaway scam

Giveaway scams offer an expensive object like a piece of equipment, vehicle or musical instrument for free, but the object doesn't actually exist. If someone responds, the scammers ask for money to pay for inspection or delivery, then cut off contact.

Items we've seen in these scams include a Yamaha baby grand piano, an industrial welding machine and an Airstream Sport travel trailer.

These scams often target UVic employees and occasionally target students.

How it works

• The email often includes detailed information and photos of the object to make it seem more legitimate.
• The email usually appears to be sent out to a large group of people. It offers the item to the first person who responds, which creates a sense of urgency.
• The object is usually described as part of an inheritance. The scammer will try to use sympathy for a grieving person to manipulate targets.
• The email may look like it's coming from a colleague or manager at UVic or a friend, family member or lawyer of a retired colleague.

Example of the scam

How to avoid these scams

Be cautious when someone:

• claims to work for UVic but isn't using a UVic email address
• asks you for non-UVic contact information
• insists on taking cash to arrange services from a third party instead of allowing you to hire them yourself
• won't show you goods or products they're offering in person

Examples from the Phish Bowl

•  (February 2025)
•  (May 2024)
•  (May 2024)

Corporate notification scam

Corporate notification scams will mimic real companies. Scammers design email or text messages that look like legitimate notifications from real software or companies.

Corporate notification scams that target employees usually mimic major IT business services and logistics companies like Microsoft, Docusign, Canada Post, UPS and Purolator. They often specifically use services and companies that UVic has a real relationship with.

Corporate notification scams that target students or a wider group often mimic popular companies in the tech and shipping sectors like Netflix, Amazon, Rogers and Telus.

Learn more

CRA tax scam

Tax scams involve scammers pretending to be from the Canada Revenue Agency (CRA). They are extremely common around tax season (mid February to mid June). Emails, text messages and voice calls are all common. Scammers may claim that:

• You've received a secure message about your taxes and need to do something to read it.
• You're owed a return and need to do something to do something to receive or claim it.
• You owe additional money and need to pay it immediately.
• You're being investigated for tax fraud.

Everyone in Canada is targeted for these sorts of scams, not UVic students or employees in particular.

Examples from the Phish Bowl

•  (October 2022)

Learn more

Housing scam

Housing scams involve a scammer pretending to be the landlord or manager of property that isn't available for rent, is different than advertised or doesn't belong to them.

Most housing scams are done with ads on buy-and-sell websites, not email. UVic students, especially students from outside of Victoria, are often targeted for this type of scam.

How it works

Housing scams can take many forms:

• Rental deposit scams: Scammers advertise a property and ask for a deposit or personal information before you have seen it.
• Phantom rentals: Scammers create fake listings for properties that don't exist using stolen photos and appealing descriptions. They may list the same property multiple times with different addresses and small changes.
• Identity theft: Scammers use ads to trick you into giving them confidential information like your SIN or banking information.
• Government program impersonation: Scammers pose as representatives from government programs for low-income housing. They may create fake waiting lists on social media platforms.

How to avoid them

• Never pay money without verifying the property's existence and confirming the landlord's identity.
• Meet the landlord in person.
• Conduct research like looking up the address and making sure the photos match the property.
• Demand a written lease.
• Never mail or wire money to anyone if you have not signed a lease.
  

Learn more