Email Scam Warning: Do not enter your username and password on fake UAOnline login page

Attention UA students and employees,

There have been a number of very convincing Phishing emails sent to alaska.edu accounts asking recipients to enter their username and password at UAOnline. The subject lines include eRefunds or Direct Deposit Information. Do not enter your username and password on the fake UAOnline login page.

If you receive a suspicious looking link, you can check it out by rolling over it with your cursor to see where the link is going. If it is not going to a location you recognize, do not click on it. In these phishing emails, the link to the fake UAOnline indicates it is going to another location (https://cas.uuco.us...) when you roll over it.

The link sends the user to a fake UAONLINE with a screen that looks a lot like the UA single sign-on site. Notice the cas.uuco.us in the corner, which is a tip-off that this is not our link. Plus, our SSO screen has additional information.

Fake UAOnline login page with cas.uuco.us in the upper corner

If you believe you have received one of these emails, and took action by following the link and entering your credentials, please change your password via ELMO immediately and report this to ua-oit-security@alaska.edu for follow-up.

If you receive one of these messages or other phishing attempts in your Google email, mark the email as "phishing" by clicking the three More dots on the right of the email and select Report Phishing. This will alert Google that this email is fraudulent and help keep it out of other UA inboxes.

Do not enter UAOnline, Blackboard, or any university service through a link in an email – enter the address directly into your browser.

These scammers are exceptionally good, so you have to be vigilant. For more information go to https://alaska.edu/ securitymatters/training/ files/fivewaystospotaphish.php.