Advisory Security Notice: Identity Theft | Information Security at York

There is a confirmed Covid-19 phishing campaign targeting the York University Community. Members who have fallen for this scam could be a victim of identity theft.

According to the Department of the Solicitor General of Canada, identity theft refers to "all types of crime in which someone wrongfully obtains and uses another person's personal data in some way that involves fraud or deception, typically for economic gain", such as:

Accessing your computer/email
Access your bank accounts
Open new bank accounts
Transfer bank balances
Apply for loans and credit cards
Buy goods and services
Get passports or receive government benefits
Hide other criminal activities

Depending on the specific information at risk (i.e., what you entered into the fraudulent website), we recommend taking immediate action to secure any accounts you have and notify appropriate authorities:

Change any passwords you may have shared (if applicable), at York or any other accounts that may use that password
Ensure you are using York’s 2-Factor Authentication
Report it to York at infosec@yorku.ca – if you have not already done so
Report it to your bank or other financial institution(s) you have accounts with
Notify credit agencies Equifax and TransUnion to enable alerts to notify you of any unauthorized credit inquiries
Report the incident the Canadian Anti-Fraud Centre
Notify local law enforcement of the incident

While there is no guaranteed strategy to avoid identity theft, you can minimize your risks and guard your personal information by following these tips.

General

Never leave bill payments in your room, office, or apartment lobby for the mail carrier to pick up. Before you leave on vacation, call, or visit your post office and request that your mail be held until you return.
Give out your Social Insurance number only when absolutely necessary – for example, on a job application or for your account. Do not include it when you are writing a personal check at a store or applying for membership at entertainment stores, grocery stores, and so on.
Keep all your personal and account information out of sight in a safe place, preferably a locked drawer or cabinet.
Shred credit card applications, health insurance statements, and anything else containing your Social Insurance number before discarding them.

Debit Cards

Never write your PIN (personal identification number) on the back of your card or on a piece of paper in your wallet or handbag.
Do not choose a PIN that uses digits from your birth date, Social Insurance number, telephone number, or street address.

Credit Cards

Keep a record of all your account numbers, expiration dates, and the phone number of each credit card issuer in a secure place for quick reference in case of loss or theft.
When you make an online purchase, be sure you’re in a secure section of the Web site; the “http://” address should change to “https://” (the “s” strands for secure), and a lock or key symbol should appear in a lower corner of the Web page.
Save your receipts, and when your billing statement comes, open it promptly and compare the two. If there is a charge you know you did not make, call the card issuer immediately and follow up by writing to their billing inquiries address and reporting it to the police.
Sign your new or replacement card as soon as you receive it. Cut up the old card so the numbers cannot be read.
Never write your account number on the outside of the payment envelope.
Don’t give your account number over the phone unless you initiated the call to make a purchase, and you’re sure the company is reputable.
Be alert for others looking over your shoulder or clerks who spend too much time looking at your card.
Every year, order a copy of your credit report from major credit-reporting agencies to make sure it is accurate.