Canvas Phishing Response

Here is a brief summary of the suspicious elements of this particular phishing email.

• The sender’s email address had nothing to do with Canvas/Instructure, and misspelled Siena.
• The links in the email (if you hover over them) don’t lead to Canvas and appear to be suspicious.
• Have you ever received an email like this from Canvas? This is not a traditional message from them. Usually if there is a problem with your submissions, Canvas will provide feedback as you are uploading them, or your instructor might reach out to you directly.
• Did you even submit an assignment on Canvas recently to prompt this message? If not, you should be wary of a message like this. Especially since it doesn't even mention what your upload was.
• Always exercise caution when an email creates a sense of urgency. The email says to “immediately” re-upload your last submission. Social engineering tactics exploit our basic human impulse to respond to urgent requests.

 

Below is an example of what a legitimate Canvas email looks like.  Instead of saying “Instructure Canvas” before the sender’s email address, it might say the name of your course, or your instructor’s name, but Canvas emails would always come from notifications@instructure.com

 

The landing page you attempted to log into also had some obvious clues even though it looks like a real page (scammers can easily scrape real pages and create legitimate looking copies):

A real phishing attack like this could put both you and Siena at risk. This exercise was done to show a plausible phishing message and to teach our community how to possibly site such scams and avoid sharing sensitive information with them.

If you ever have doubts about a link in an email or if the email appears to be suspicious at all, simply log into the site directly, reach out to the sender through a separate channel (such as a phone call or speak to them face-to-face) to ensure it is legitimate, or contact the ITS Help Desk.  In this case, you could have directly logged into Canvas to see if there was a problem with your submission (if you even made a recent submission).

Use your best judgement when reviewing all email and phone calls and if you ever have a question on the legitimacy of an email you can always contact the ITS Help Desk.