Phish: International authority impersonation scam

Published: February 25, 2026

This phishing attempt targets international students by pretending to notify them about an “urgent investigation” linked to their identification number. The scam uses intimidating language, claims of legal consequences and pressure to respond privately. The sender pretends to represent an official‑sounding agency and asks for personal and financial information. These tactics are typical of scams designed to scare students into handing over sensitive details or money.

Email details

Subject:

Immediate Action Required: Verification of Your Student File

Dear Student,

Your identification number has been flagged in an international investigation connected to serious misconduct. To prevent suspension of your status in Canada, you must complete a confidential verification. If you do not respond within 24 hours, your file may be forwarded to federal authorities for further review.

To begin, reply directly to this email so we can connect you with the assigned officer. Do not discuss this case with anyone, including your school or family, as this matter is classified.

You must provide:

Full name and date of birth
Address and phone number in Canada
A list of your bank accounts for verification

Failure to follow this instruction may result in immediate restrictions being placed on your file.

Sincerely,
International Verification Division
Case ID: 553-22A

Phishing cues

Poses as a trusted or legitimate source

Uses a vague but official‑sounding authority (“International Verification Division”) to sound credible.
Generic greeting

Uses “Dear Student” instead of the person’s name.
Sense of urgency

Says action is required “within 24 hours” and implies consequences if they do not follow the instructions.
Threatening language

References “serious misconduct,” “federal authorities” and “classified” information and other legal-sounding terms to pressure the reader.
Requests for sensitive information

Asks for name, date of birth, address, phone number and banking details.
Lack of contact information

No signature, phone number, office location or verifiable details.

Report phishing

If you receive a suspicious email, do not open attachments or click on links. Report phishing attempts to security.response@utoronto.ca.

Phish Bowl

Phish Bowl

Phish Bowl