The Phish Tank

Phishing Impersonation

Welcome to the "Phish Tank"

This page highlights examples of phishing emails received on campus. These examples are intended to educate every Berkeley email user on how to spot a phish. If you receive an email not listed here and that seems suspicious, report it via the methods listed above. For more tips on avoiding phish, visit our Fight the Phish page.

We encourage everyone to protect themselves against phishing attacks.

We created the "Fight the Phish" campaign to educate you on ways to avoid and recognize phishing. These materials are free to use and share within the UC Berkeley community, so feel free to promote them around your department, classroom, or home office.

Fake Debt Collection Google Doc Share

April 17, 2025

Unknown parties are sending fake Google Doc Shares with an urgent subject line. They usually refer to lawsuits or debt collection.

The bad actor is using the same Google Doc service, so the 'from' email will be the service email (via Google Drive)" <...Read more about Fake Debt Collection Google Doc Share

Fake Electronic Payment ACH Message

April 9, 2025

Many bMail account holders have recently received fake messages indicating an ACH Payment or Electronic Fund transfer.

What makes this a phishing message?

This targeted phishing scam pretending to be a UC Berkeley technician. This targeted phishing scam uses urgency and fear to cause the...Read more about Fake Electronic Payment ACH Message

Jan 2025 bCourses Audit Attempts

January 22, 2025

An ineligible former Summer Session student is attempting to contact faculty directly and be added to many bCourses.

What makes this a phishing message?

In the Spring of 2024, a very similar incident occurred. The messages are usually send from an @gmail.com account, but may come from @...Read more about Jan 2025 bCourses Audit Attempts

Phony Staff Assessment Doc Link

January 21, 2025

This phony Staff Assessment notification was received by many bMail users. It is part of a credential stealing attempt.

What makes this a phishing message?

The senders email is not a @berkeley.edu email, likely a compromised account from the Austin, TX school district @austinisd.org...Read more about Phony Staff Assessment Doc Link

Fake UC Berkeley Financial Support Program

December 4, 2024

This phony email was sent impersonating a UC Berkeley administrative department. It was attempting to get users to click with a bogus $2,250 financial bonus for eligible faculty and staff.

What makes this a phishing message?

The sender is not an @berkeley.edu sender and the login page is...Read more about Fake UC Berkeley Financial Support Program

Fake Email Account Suspension email

December 2, 2024

This fake email termination message was received by many users allegedly telling them their campus email account would be suspended.

Commonly used phony subject lines include:

'ADVANCE WARNING'

'***Urgent*** Your Account Will Be Suspended'

'ATTENTION...Read more about Fake Email Account Suspension email

Phony Remote virtual Assistant Job

December 2, 2024

This is a fraudulent offer for a remote assistant position. The scammer will impersonate a real UCB professor or department and try to take the conversation offline to a 'personal email' address.

Common bogus email subject lines include:

'Approved Part - Time Job...Read more about Phony Remote virtual Assistant Job

Fake: One of Your Students has Covid Phish

November 12, 2024

This fake email was sent to a number of teaching faculty members, alerting them falsely that they were exposed to a student in class with Covid.

What makes this a phishing message?

This targeted phishing scam pretending to be a UC WarnMe Health alert.

This targeted phishing scam...Read more about Fake: One of Your Students has Covid Phish

Fake: Phony Docusign Termination Email

October 1, 2024
What makes this a phishing message?

This email has been specifically targeting UC Berkeley Executives and asks them to click a link and enter their credentials to review an employee termination agreement.

Tips if Something Seems Off:

The sender name indicates an official Docusign like...Read more about Fake: Phony Docusign Termination Email

Fake: New Sextortion Scam with Geolocation Data

October 1, 2024
What makes this a phishing message?

This is a classic 'sextortion' hoax from a random GMail email address.

https://www.bbb.org/article/news-releases/20517-scam-alert-beware-of...Read more about Fake: New Sextortion Scam with Geolocation Data

Fake: URGENT: COVID-19 Variant Case Alert

July 3, 2024

This phony potential Covid contact alert was received by many users sent to their Campus bMail accounts.

What makes this a phishing message?

This targeted phishing scam is using a fake UC Berkeley email address

From: UC Berkeley Alerts <...Read more about Fake: URGENT: COVID-19 Variant Case Alert

PHISHING EXAMPLE: Phony Email confirmation Text Message

June 11, 2024

This fake email termination notification was received by many users on their personal cell phone numbers via text message.

What makes this a phishing message?

This targeted phishing scam is pretending to be a UC Berkeley technician and uses urgency and fear to cause the recipients...Read more about PHISHING EXAMPLE: Phony Email confirmation Text Message