IT staff have discovered two phishing scam emails which ask the recipient to reply with their password. Both take advantage of the recipient's fear and present a sense of urgency.
One email has a subject of "Vcu Upgrade Notification" and the other has a subject of "Dear Vcu Mail User". Both claim to be from "Vcu Help Desk", have a sender name of Help Desk Services" and a spoofed email address of "info@vcu.edu". The reply-to email address is "h.desks7@ymail.com".
The first email tells the recipient that maintenance is being done on VCU email accounts and the user's password is needed, otherwise the user's account may be suspended.
The second email tells the recipient that their mailbox has reached 18 MB in size and that if it reaches 25 MB, incoming email will be blocked. Not surprisingly, the user's password is needed to address the issue.
VCU's Technology Services staff and other VCU business units will never ask you to email your password. Per VCU's Password Standard:
Passwords must be kept secret and must not be shared.
and
Passwords must not be inserted into email messages or other forms of electronic communication...
A user responded to both emails with her password and other details that were requested. As a result, the user's email account was compromised and used to send out thousands of spam emails.
The resulting flood of spam from VCU's servers sometimes results in the recipients' ISPs blocking email from all VCU users. Though these phishers aren't generally interested in your personal information, with your password they could read your email and access other resources with your account, such as Blackboard, the portal, and Banner Self Service.
If you receive this email, or one like it, please delete it and do not respond to it. If you accidentally respond, change your password immediately and contact the VCU Help Desk to notify them that your password may have been compromised.