To catch a phish: tips for Cyber Security Awareness Month | The Quad

Top up your cybersecurity survival kit with the Office of the Chief Information Security Officer (CISO)! October is Cyber Security Awareness Month, and we're challenging you to look closely at the evolution of cybercrime and check that you've kept up.

Advice on creating strong passwords to protect your accounts has changed over the years. Adding a number or swapping a letter for a symbol is no longer enough on its own. Today, better ways to keep your accounts secure mean you have fewer reasons to memorize dozens of passwords.

For accounts that use passwords, make each one long, unique and hard to predict. A password manager makes this easier by generating and storing a different password for each account in an encrypted vault. You don't have to remember every password, and if one is exposed in a breach, it won't give someone access to your other accounts. Protect your password manager with a strong, unique master passphrase and multi-factor authentication (MFA), where supported. A passphrase is a password made from a sentence or a combination of unrelated words. For example, "Waffle-Moose-Tuxedo-Pluto" combines unrelated words into something memorable. And remember: Never reuse your university password for another service.

You may also see services offering passkeys. A passkey lets you sign in without typing a password, usually by unlocking your device with your fingerprint, face or PIN. Unlike passwords, passkeys are tied to the legitimate website or app, helping protect you from fake sign-in pages designed to steal your credentials.

For personal accounts that offer passkeys, consider enabling them. Passkeys are not currently supported for your CCID. For your university account, continue using a strong, unique password and the university's supported MFA options.

Strong passwords and MFA help protect your accounts, but attackers will still try to trick you into letting them in. A fake transcript, an account expiration notice or an alleged academic integrity violation can be an effective lure that leads you to a fake sign-in page. This is called phishing and it can be difficult to identify. Please see the example below:


Dear Employees,

We are pleased to inform you that your salary increase has been approved. We sincerely appreciate your hard work and dedication to the University of Alberta, and this adjustment reflects the value of your contribution.

Effective Friday, January 9, 2026, your salary will increase by 16.82%. This adjustment recognizes your efforts and supports our continued commitment to rewarding our valued employees.

Note: Your access is required to review the official salary increment letter.

Initial access code: Salary2026

We look forward to your continued contributions and success at the University of Alberta.

Sincerely,

Payroll & Employee Relations

Ticket attachments: 1. Salary_Increase_Notification_2026.pdf

Phishing is when a fraudulent email, sent from a seemingly legitimate organization or person, tries to convince individuals to divulge personal information, such as passwords or credit card numbers. Links in phishing emails often lead to fake sites that encourage you to send personal or financial information to criminals.

Phishing messages aren't always easy to recognize, but a few habits can help you to spot them:

• Pause when a message creates urgency. Threats of account closure or demands for immediate action are reasons to slow down and check, even when the message looks convincing.
• Open the service directly. If a message asks you to sign in or fix an account problem, use a trusted bookmark or link instead of the one in the message.
• Verify unexpected requests. If someone asks for sensitive information, payment or a change to banking details, contact them using a phone number or another contact method you trust.
• Be careful with MFA requests. Only approve a request when you initiate it. Deny unexpected requests, and never share verification codes with someone who asks for them.

Technology is always evolving, and so are cybercriminals. You need to evolve right along with them. The further you fall behind, the more you open yourself up to a serious data breach.

Ready to evolve? Check CISO's website for the latest information on how to stay safe online.

Cyber Security Awareness Month is an internationally recognized campaign held each October, giving our campus community an opportunity to refocus on staying secure in an increasingly digital world. For more tips on how to keep your data safe, visit the University of Alberta's chief information security officer's (CISO) website.