Keyboard with money being taken away by a fishing hook

8/16 Phishing Alert! Subject: “Benefits”

The UW–Madison Office of Cybersecurity is aware of an active phishing campaign on campus in which the attacker offers to “provide $2300 in assistance for qualifying employees who are experiencing financial hardship.” See the screenshot:

Screenshot of phishing message

NOTE: The most recently reported phishing email like this example was sent August 16, but such attacks can occur at any time. Please be on the lookout.


How can I identify this phishing attempt?

  • The first paragraph contains a spelling/grammatical error: “support all Student & employees to get through these hard times.”
  • The hyperlinked “WSC COVID-19 Benefits” text contains a spelling error (WSC instead of WISC) and links to a non-UW cabanova.com URL.

Always scroll over each hyperlink

The most important habit to practice in order to protect yourself from phishing attempts is to always scroll over each hyperlink, whether words or URL, to see what web address the link actually goes to. When you scroll over a hyperlink, its destination URL displays as a tool tip.

What should I do if I receive this phishing attempt?

Outlook users:
To report phishing emails received via Outlook, please click the “Report Phish” button on the toolbar/ribbon located at the top of your page. This action will send the questionable email to the UW–Madison Cybersecurity Operations Center (CSOC). 

Non-Outlook users: 
If you do not see the “Report Phishing” button, then forward the message as an attachment  (Source: KB 34567) to abuse@wisc.edu. Please do not simply forward the questionable email, as this will prevent us from seeing the header of the message and make it difficult to take appropriate action.

For additional information, please refer to: Office 365 – Submit a message as spam/phishing (Source: KB 45051).

If you are ever unsure whether an email message is legitimate, DO NOT RESPOND to it! Instead, contact the DoIT Help Desk (608) 264-HELP (4357) and ask for advice.

What should I do if I accidentally clicked one of the fake portal links?

Immediately change your NetID password by following the instructions in NetID: Changing a Password (Source: KB 20589).

Also the Office of Cybersecurity recommends the following if you submitted any information after clicking:

  • Report stolen credit card information to the appropriate Banking institution.
  • Report the identity theft to your local PD and to the Federal Trade Commission’s identitytheft.gov website.

How can I learn how to recognize other phishing attempts?

Go to Learn how to recognize and report phishing (Source: it.wisc.edu).

Stay updated on phishing attempts by visiting our Scam alerts page (Source: it.wisc.edu).