What is this?
Information on and examples of recent email phishing attempts on NSCC accounts.
Requests to update your banking information or profile
October 31, 2018: Emails are being sent from an @nscc.ca email account asking users to update their Scotiabank banking information or online banking profile.
This email has been spoofed and was not actually sent from an NSCC account.
Always remember to check the email address of any email claiming to be from your financial institution. Most banks or other large organizations dealing with your personal information will not send email requests to update your profile or information. Remember: be suspicious!
Personalized Phishing - Replies to a previous email conversation
September 4, 2018: NSCC Digital Innovation and Technology staff are aware of and actively responding to a number of personalized phishing emails being received by NSCC Students and Staff.
The emails originate from an account that the attacker has compromised. This account may be either an NSCC email account or another outside account that you have emailed in the past. The attacker is using the valid email of the compromised account to target users by replying to past email threads, replacing the body of the email with their malicious payload.
It is important to note the recipients of this specific email phish previously had legitimate email contact with the sender using exactly the same subject line.
The following is an example of the email (hyperlinks and personal information have been removed):
This email employs a tactic that we see in a lot of spam by attempting to convince the recipient to click a link that will open a web page.
This hyperlink it takes you to a personalized web page that is designed to look like a NSCC Office 365 web page and includes your email address:
If a user provides their password to this web form the attacker will rerun this attack using this new compromised email account.
This phishing email poses a higher than normal risk to the NSCC community.
If there is any chance that your password may have been compromised please change it immediately. Instructions on how to do so can be found here: Password Management Tool.
If you think your account may have been compromised, please log a ticket in Technology Service Desk or contact your local Digital Innovation and Technology office during business hours for help.
Gift Card requests
The College has recently been the target of a phishing attempt involving an email that appears to come from our president. We want to take this opportunity to share with you an example of an email received by a staff member and helpful hints to identify phishing attempts that you might receive now or in the future.
Some indicators that this email is an email phishing attack:
If you receive this email or any email that appears unconventional in nature, including from NSCC colleagues, please take the time to review it with these points in mind.
Before responding you can always call a colleague to confirm that it is a legitimate request or contact your Digital Innovation & Technology representative if you are not sure.
You can report it to our DI&Tech Security Teamwith the 'Report Suspicous Message" button in Outlook, or you can log a ticket in Technology Service Desk.