I am beginning to see a few versions of this phishing scam, but they are all attempts to steal your password. The message may come from MS – Utk – Portal or Tennessee1 or any number of possibilities. They all tell you that your password for Microsoft 365 is expiring and it gives you the ability to keep your current password. Here is where you need to pay close attention:

• The address that goes with the senders “name” is not a utk.edu address. For instance, the one from MS – UTK – Portal came from GwZEL@goshen.edu.
• The message from Tennessee1 has the date in dd/mm/yyyy format, which the US typically does not use, nor does the University.
• Both of these formats have punctuation errors or no punctuation at all, which is not likely going to come from an institute of higher learning.
• UTK is written as “Utk,” which will not happen.
• Most importantly, your Microsoft 365 account is using your NetID and password. While the message I got from MS – UTK – Portal has my NetID in the message, Microsoft will not notify that I need to change my NetID password, OIT will do that.

Please forward these messages to abuse@utk.edu and use the Report Phishing Attempts instructions. If you have any questions or concerns, please let me know.

Sandy