Skip to main content
U of T Resource Finder

Scam Awareness

Many members of the University community have reported a wide range of frauds and scams. Many fraud and scam attacks are common forms of social engineering, used to target people in the form of malicious emails or messages. These attempts are on the rise and becoming more sophisticated and polished. Fraud and scam attacks are designed to confuse the recipient and to prey on human emotions such as fear, curiosity, or excitement to create a sense of urgency which prompts the victim to respond to the fraudster and expose themselves to risk.

Person working on a laptop

Types of Scams

Students should be aware of the following types of scams that they might encounter while at U of T and beyond.

Scammers often target incoming students with false admissions and scholarship postings on social media, particularly closed Facebook scholarship-seeking groups. The University is aware of third parties worldwide impersonating its staff and officers and offering fraudulent admissions and scholarships.

Scammers post fake scholarship offers and special admission programs for incoming University of Toronto students on social media, bypassing regular application methods. They often pose as University staff or professors, using screenshots of UofT logos and images to appear legitimate. Once a student shows interest or applies, the scammer contacts them, often via WhatsApp, claiming guaranteed access to the scholarship or admission in exchange for an application or processing fee. Students usually receive a fake, official-looking letter with instructions, but the application fee is lost.

If you suspect you’ve been targeted by a fraud or scam involving a fake admission or scholarship offer, report it to local law enforcement. If you have concerns about a suspicious posting or are unsure of a scholarship program’s legitimacy or its affiliation with the University of Toronto, contact the University’s admissions office before engaging.

The University of Toronto never makes unsolicited scholarship or admission offers, so be skeptical of any unsolicited offers you receive. Scholarships or financial aid are only offered after admission decisions are made, so if you haven’t been admitted, any scholarship offer is likely a scam. The University never sends official documents, including admission or scholarship offers, through WhatsApp or other social media platforms. Official communications from the University always come from @utoronto.ca email addresses, so be sure to verify the sender of any email.

Be wary of emails urging you to click links, enter credentials, download attachments, or send money, especially with urgent threats (e.g., “your account will be terminated”). The University of Toronto accepts undergraduate applications only through the Ontario Universities’ Application Centre (OUAC) or the U of T International Application on OUAC, and application fees are paid directly to OUAC, never to a representative. University representatives cannot legally offer study permits—admitted students must apply for a study permit through Immigration, Refugees and Citizenship Canada (IRCC), a department of Canada’s federal government.

Scammers are targeting university students through phishing emails from spoofed email addresses or through fake job postings on social media. They pose as a not for profit or a small business and advertise part-time, remote employment opportunities online. The jobs are entirely virtual and do not have a rigorous application process and may be paid in a foreign currency ($USD).

Don’t accept items or provide personal information for contests or jobs you never applied for it and verify the identity of anyone offering you employment, even if it looks like they work for a legitimate organization – Many employment frauds start as phishing emails that use logos from actual companies and email accounts. No legitimate employer will ask you to deposit company funds into your personal banking account to make payments to other parties on behalf of the organization or to request verification of banking information, application fees, money or passwords.

If you suspect that you may be the victim or being targeted in a scam, consider making a report to your local police or U of T’s Campus Safety Office. Make sure to document everything: Take screenshots of your communications with the individual (including URLs, names, email addresses, social media handles, and emails, text messages or direct messages) and save and copy all messages that have been sent to you.  You may need this information when making a report to the police.

Fraudsters are targeting international students by impersonating authority figures (border officials, police officers, Canada Revenue Agency Agents, immigration officers, etc.) to manipulate and scare students into complying with their demands.

Victims receive automated calls, seemingly from delivery company or Chinese police, regarding an intercepted package containing illegal goods, or about issues with their immigration papers.  They are then connected to a person claiming to be from the police or delivery company. Victims are threatened with arrest and deportation but offered an opportunity to pay a fine to avoid consequences. These calls are often intimidating and threatening.

If you suspect that you may be the victim of a law enforcement fraud, consider making an appointment with U of T’s Community Safety Office to discuss your options or making a report to Campus Safety or to Municipal Police. Regardless of whether you know the person who is threatening you, take a screenshot of their URL/Name/Email Address/handle or make a note of their phone number Crypto-currency address, etc. Save and copy all messages that have been sent to you and use as evidence when making a report to the police. Avoid further interaction and consider securing your social media accounts.

Do not always trust caller ID/call display on your phone – scammers can manipulate it to appear as law enforcement. An actual law enforcement or legitimate government official will never fault you for verifying their identity before you engage with them. Legitimate officials will never demand money for Canadian status or request payment via cryptocurrency, prepaid credit cards, or wire transfers. Government agencies will not threaten arrest or use aggressive language. Always verify identities through official channels before engaging.

During the holidays, illegitimate companies and online purchasing websites target all community members at U of T.

If you purchased something online using your credit card, debit card, or a gift card, and the package never arrives or you receive something drastically different (in appearance and/or quality) from what you ordered, you may be the victim of a package delivery scam. If someone contacts you claiming to be from a law enforcement agency and says they’ve intercepted a package you have sent that contains illegal items, it is also a scam (especially if you never sent or ordered a package). Legitimate law enforcement will never request payment to avoid charges.

If you suspect you may be the victim of a package delivery scam, consider making a report to U of T’s Campus Safety or to Municipal Police. You can also report a fraudulent charge to your credit card company or bank. Make sure to save all receipts, invoices, delivery status notifications, and communications that have been sent to you – you may need this information when filing a police report.

To avoid package delivery scams, make sure you shop with reputable vendors or vendors that you’re familiar with. If you come across special holiday deals that seem too good to be true – and if the website isn’t familiar to you – do your research before moving forward with your purchase. Make sure to connect to a password-protected Wi-Fi network that you trust when inputting any personal information online, and avoid inputting sensitive personal or financial information on a webpage you don’t trust (make sure it begins with https and shows the lock icon). If you need to use public Wi-Fi to make a purchase, connect to a virtual private network (VPN), which creates an encrypted tunnel between your computer and the server. This stops hackers from intercepting your personal information.

When an online retailer requires you to create an account to make a purchase, make sure to create a strong password. Once you make it to the payment page, it’s recommended to use a credit card instead of a debit card for your purchase.

Scammers use phishing emails and text messages to steal personal information, such as passwords, social insurance numbers, and banking details. They trick victims into clicking links and filling out fake forms, giving criminals access to financial accounts. Once they have this information, they can open credit cards and accumulate debt in your name.

If you are concerned that you may have shared your personal information (e.g., SIN or credit card number) with a scammer, the CRA advises you to contact the police. If you suspect your SIN has been stolen, reach out to Service Canada at 1-800-206-7218. Visit their website for more information. You can also seek support from U of T’s Community Safety Office and report the incident to Campus Safety or Municipal Police.

Protect yourself by limiting the personal information you share online. Fraudsters mine social media for details about your location, studies, and personal life to craft convincing scams. Secure your contact details and avoid sharing your residence location. Stay vigilant and Google yourself to see what information is publicly available.

Scammers target incoming international students with false social media and search engine ads. Posing as unauthorized immigration advisors, they scam students out of money, leading to refused or returned applications. The Immigration Canada Website states, “We won’t deal with representatives who charge a fee but are not authorized. If you use an unauthorized representative in Canada or abroad, we may return your application or refuse it.”

Fraudsters offer immigration services at lower fees than their legitimate counterparts and charge upfront for application assistance. As unauthorized advisors, they cause applications to be refused and may jeopardize the student’s study permit eligibility.

If you lost money to a fake immigration advisor, report it to your local law enforcement. If you suspect you have been involved with a fake immigration advisor, contact your International Student Services Office. They can help you determine what happened, recommend making a report with Immigration Canada, and find an appropriate advisor to assist you. You can also contact them with questions about the study permit application process.

University of Toronto representatives cannot legally offer study permits. Admitted students must apply for a study permit through Immigration, Refugees and Citizenship Canada (IRCC), a department of Canada’s federal government. Research the requirements for licensed advisors on the Immigration Canada website or consult the University of Toronto International Student Immigration Advising Team. Only authorized representatives can charge fees. Verify their authorization here. Avoid payment methods such as cash, wire transfers, MoneyGram, Bitcoin, or MoneyPak as they are impossible to track and likely scams.

ArriveCAN is the official, free platform from the Government of Canada for providing an individual’s information when entering Canada. It will never ask for payment or any credit card information! Be cautious with search engine results, as scammers pay to have their site among the top suggestions. Be wary about sharing personal information with anyone and always verify that you are dealing with a trusted source.

Scammers target students with false housing advertisements on sites like Kijiji and Craigslist, exploiting those unable to visit properties or meet landlords. With Toronto’s competitive rental market, especially for September leases, many students lose their deposits to fraud.

Scammers post non-existent or unavailable properties to take your money before you realize it. They might also pose as landlords, using fake contact information or collecting deposits for already rented places. Some may try to get you to sign a lease or pay a deposit for a different property. Suspicious money requests include asking for money before you’ve seen the apartment, paying illegal fees like security deposits or full rent upfront, or being asked to wire money. Never send money to someone you haven’t met or for a place you haven’t viewed.

If you suspect you’ve been scammed, consider making an appointment with Housing Services for guidance on your next steps. If you’ve lost money, report it to Campus Safety or Municipal Police. Be sure to save all messages from the landlord, as you may need them when making a report. Do not engage further with the scammer. If you’ve shared personal information that could compromise you, such as your SIN number or banking details, seek advice from U of T’s Community Safety Office.

To stay safe, always conduct basic research. Be wary of rentals priced significantly below market value or those that seem too good to be true. Search for the owner and listing; if you find the same ad under a different name, it may be a scam. Start by Googling the property’s address. Ensure you view the unit, sign the lease, and receive the keys before paying any money. Never rent sight unseen—meet the landlord in person. Consider verified property management companies if you’re renting outside the GTA and can’t view it in person. Landlords can only legally request last month’s rent and a refundable key deposit at lease signing–no other fees are legal. Never pay a deposit with cash, wire transfer, Moneygram, Bitcoin, or MoneyPak, as these payments are untraceable.

Phishing is a cyber-attack where fraudulent emails trick people into revealing personal information through fake forms or malicious attachments. These emails often create a sense of urgency. With more remote work, these scams are becoming more sophisticated. Ransomware is a type of malicious software (malware) that is designed to extort money from its victims by blocking or preventing them from accessing data on their systems.

Scammers impersonate trusted entities like banks or government officials, urging you to update personal information or claiming you’ve won a prize. They often include links or attachments that compromise your information. Perpetrators of ransomware attacks generally threaten to publish sensitive information, or to deny access to a system or data until the victim pays a ransom fee to the attacker. In many cases, the ransom demand comes with a deadline and if the victim fails to pay the ransom amount by that deadline their access to their data is permanently deleted, or the ransom demand increases.

Report phishing emails using the “report message” function in Office 365/UTMail+ or email report.phishing@utoronto.ca. If you opened an attachment that was provided in a phishing email, contact your local IT service desk immediately. If you suspect your password may have been compromised due to an attack, immediately change it. Verify email addresses and links before clicking and use the Phish Bowl to check if an email has been reported. When in doubt, verify suspicious emails directly with the sender. Enable multi-factor authentication (MFA) for your Microsoft 365 account and look for external email banners in UTMail+ to spot emails from outside the University. Always use a VPN when working remotely. Be cautious of unsolicited requests for personal info, and watch for common signs of phishing, like spelling errors or fake links. Phishing emails often include fake attachments or links that appear legitimate but are designed to harm you.

If you think your personal information has been compromised, consider making an appointment with U of T’s Community Safety Office to review recommendations on securing your profile.

Bitcoin, a virtual cryptocurrency, is untraceable and enables anonymous payments, making it a preferred method of payment in scams such as extortion, phishing emails, landlord/rental scams, and ransomware. Unlike traceable payments made via banks or credit cards, cryptocurrency transactions are irreversible, leaving victims without recourse if defrauded. Fraudsters exploit Bitcoin’s lack of regulation and anonymity by requesting it for payment in various schemes.

To avoid falling victim, remember that no Canadian government agency, bank, school, or police officer will ever demand payment in Bitcoin, as it is not legal tender in Canada. If you receive unsolicited communication demanding payment in Bitcoin, assume it is a scam—end the call, block the number, and refrain from sharing personal or financial information. If you suspect that you may be the victim or being targeted in a Bitcoin or Crypto-currency fraud scheme, report it to U of T’s Campus Safety Office or Municipal Police, seek trusted advice, and save all relevant communications, including screenshots and message copies, for evidence when making a report.

Fraudsters can use social media to mine information on targets for a variety of scams, including identity theft, catfishing, extortion/sextortion, law enforcement impersonation scams, and more. Practicing good social media safety and hygiene can help mitigate your risk of being targeted.

To stay safe online, we recommend you stay vigilant about the information that is available about you, especially your location, family, pets, and program of study – fraudsters may use this to appear legitimate. Ensure your contact information (phone number, email, social media login information, student number, home address) stays secure and offline. When you’re posting on social media, make sure your posts don’t reveal your location or your residence (whether temporary or permanent) to other users. Google yourself – you might be surprised by what’s out there!

If it’s necessary to have maintain a public social media account for career growth or advocacy, consider making a separate, private account to post about your personal life, and restricting your followers to people you know and stay connected with. Before contacting someone on social media, look at their account to verify its legitimacy and check whether you have friends in common – Digital Security for Activists

Review your social media platforms to ensure your security settings are up to date. Sometimes, application updates can change your security settings without you knowing, so it’s good practice to review them regularly and ensure nothing has changed. You might even be able to upgrade some features to further improve security! It’s also recommended to turn off your geolocator or Location Services for any applications you use.

Finally, be wary of receiving “offers” from people you do not know. Common examples are offers of employment (for jobs you never applied for), unsolicited offers for online romantic/sexual encounters, or notifications that you’ve won a contest or lottery that you didn’t apply for. If it sounds too good to be true, it probably is.

As tax season approaches, scammers posing as Canada Revenue Agency (CRA) agents or Service Canada representatives are targeting individuals through robocalls, text messages, and phishing emails. These fraudsters use scare tactics, claiming that your social insurance number (SIN) has been compromised, you owe back taxes or have committed a financial crime. They pressure victims to act immediately under the threat of arrest, fines, or deportation, often demanding payment through money services businesses, gift cards or Bitcoin.

If you receive a suspicious email relating to the CRA or tax filing, report it by using the “report message” function in U of T Office 365/UTMail+ or email report.phishing@utoronto.ca. Do not follow any instructions in the email, delete it or report it to the Canadian Anti-Fraud Centre. If you are concerned that you may have shared your personal information (e.g., SIN or credit card number) with a scammer, contact the police. If you suspect your SIN has been stolen, contact Service Canada at 1-800-206-7218.

To stay safe, never share personal information, including financial information or login credentials with unknown callers or suspicious emails. An actual law enforcement or Legitimate government officials will never fault you for verifying their identity first. When in doubt, always log into your CRA account through a trusted browser or call 1-800-959-8281. For more tax-related scams and how to protect yourself, visit the CRA security site.

During the summer months, students should be vigilant about tuition-related phishing scams. Fraudsters pose as University administration officials and contact students, falsely claiming that fees remain unpaid and threatening class removal if immediate action isn’t taken. These cyber-attacks use deceptive phishing emails designed to pressure recipients into reacting hastily. The messages often appear urgent, instructing students to follow embedded payment instructions. To enhance credibility, scammers may spoof email addresses and use the names of real University employees.

In this scam, students receive phishing emails demanding immediate payment, typically in Bitcoin via a provided link or Bitcoin machine. New and international students are particularly vulnerable, as they may not be aware that Canadian institutions, including the University, do not accept cryptocurrency as payment.

If you encounter such messages, report them using the “report message” function in your Office 365/UTMail+ inbox or email report.phishing@utoronto.ca. Verify the sender’s email address by clicking the display name, and hover over links (or long-press on mobile) to check if the URL matches the displayed text. You can also cross-reference the Phish Bowl to see if the email has already been flagged. If you suspect your personal information was compromised or you made a payment, consider reporting the incident to Campus Safety.

To prevent falling victim to scams, always verify suspicious emails by contacting the sender directly via phone or in person. Enable multi-factor authentication (MFA) for your Microsoft 365 account—U of T’s UTORMFA program enhances security. Remember, the University does not accept cryptocurrency payments. Additionally, watch for spelling and grammatical errors, as these can further indicate phishing attempts.

Resources: