Secure U of T anti-phishing protection offers you advanced threat protection from spoofing and impersonation threats.
Spoofing is when the From address in an email message (the sender address that's shown in email clients) doesn't match the domain of the email source. Impersonation is where the sender or the sender's email domain in a message looks similar to a real sender or domain. The intent is to deceive recipients.
You will benefit from important features that increase your protections from malicious impersonation-based phishing attacks and other types of phishing attacks. Please review this knowledge article to understand:
If you are unfamiliar with phishing and what it is, please review this online resource.
Advanced anti-phishing policies add an additional layer of security to your University of Toronto email account. These policies use machine learning models to identify and protect you from phishing attempts by notifying you when an email you receive seems suspicious.
Mailbox intelligence analyzes your UTmail+ mail flow patterns to determine which contacts you communicate with most often. This helps the system to more easily identify when an email message might be from an attacker who is impersonating one of your contacts. It also helps to reduce the number of false positives in your inbox by helping to ensure that legitimate messages are not inappropriately marked as spam.
The implementation of these features will be in three phases. Users may be in different phases at different times, and not all phases will apply to all users.
Phishing and spoofed email alerts for identified M365 accounts will be reviewed by IT staff to tune the service by identifying legitimate senders who could have a similar domain or display name to the accounts the University is protecting. This first phase is ‘invisible’ and will not impact your email experience.
Anti-phishing protection will alert you to possible phishing attempts by displaying safety tips in the body of suspicious emails that you receive. This will help you to determine if you should not trust the sender of an email.
There are different safety tips that could be displayed on suspicious emails that you receive. The tip that is displayed will depend on the nature of the suspicious email. You will see a safety tip when:
Identified impersonation emails (where the From address contains the name of someone at the University who the email sender could potentially be impersonating) will be automatically moved to your Junk Email folder.
Currently, all emails identified as spoofing messages (where the From address in an email message doesn't match the domain of the email source) by Microsoft will automatically go to your Junk Email folder.
Anti-impersonation emails (where the sender or the sender's email domain in a message looks similar to a real sender or domain) are not currently automatically sent to Junk Email. However, these emails could still sometimes end up in your Junk Email folder for other reasons.
If you get a suspicious email, we ask that you report it to Information Security using the ‘Report Message’ add-in or by forwarding the email to report.phishing@utoronto.ca.
If you receive an email that you believe has been incorrectly marked as suspicious, please submit a ticket to the Enterprise Service Center at uoft.me/m365help. Our Microsoft 365 team can mark the email so that it is no longer deemed malicious.
Microsoft uses machine learning to scan your emails for malicious content, but no person will ever view them.
To learn more about phishing emails and how to spot them, please review this online resource from the Government of Canada.
You can also learn more about information security at the University of Toronto from the University’s Security Matters website.