Phishing messages targeting the UMD community

Dear University Community Members,

Over the past few days, members of the UMD community have been receiving phishing emails containing alarming messages such as “your account has been set for deactivation” and asking the recipient to provide information in a Google Form, including a passcode from Duo, to prevent their account from being disabled. These messages often have concerning subject lines like "WARNING!" or "Account Deactivation!" and may appear to come from another member of the UMD community.

These unsolicited messages are phishing messages from online scammers who are attempting to get you to provide your username, passphrase, and a Duo passcode so they can utilize your email account to send additional phishing or spam messages to others.  

The Division of Information Technology (DIT) and other UMD units will never ask you to enter your username, passphrase, and Duo passcode into a Google Form or other online form. If you encounter a form asking for login details or other sensitive information, stop and contact the IT Service Desk to report the form URL and email message.

If you receive a phishing email like this, do not respond. Mark the email as spam (learn how to mark a message as spam in Gmail) or delete it from your inbox.

DIT maintains a list of scams and phishing messages UMD is seeing, which contains more about this and other common scams.

If you have additional questions, please contact the IT Service Desk.

Thank you,

Gerry Sneeringer
Chief Information Security Officer
University of Maryland
it.umd.edu