“Urgent Action Required” Emails are Fraudulent

Many users are receiving emails with the subject of “Urgent Action Required”. These emails are fraudulent. The content of the email suggests there is a problem with their account and incoming emails will be “placed on hold”. Various methods are used to convince the user the email is valid. A green banner in the body of the email says “From Microsoft Office365” and in a large font before the main text it says “Berry Account Service”, which is never a term used by OIT. Oddly, the email address is partially obscured with asterisks, but the first two letters are left exposed.

Some emails are poorly crafted, as the button which says “Review Your Recent Activity” which should be a link, is not, but the “Berry Account Service” and the partially obscured email are.

Please report these emails using the “Report Email as Phishing” button.