Stay Safe While Staying Informed
UBC has moved to the enterprise application Workday to manage many of our logistical processes. Cybercriminals are quick to pounce on the opportunity that this change has made available to them.
We have prepared the following information to arm you with the knowledge to spot some key differences in how to identify whether a Workday notification that you receive is legitimate or fraudulent:
If you receive a Workday email with a yellow external email security warning tag, forward it as an attachment to security@ubc.ca.
Legitimate Workday emails will only come from email addresses ending in @workday.svc.ubc.ca. If you can view the address of the sender from your mailbox and it contains a @workday.svc.ubc.ca suffix, you can explicitly trust these messages. You will notice that the overwhelming majority of messages will come from a single email address: noreply@workday.svc.ubc.ca.
Review Samples
| In general, Workday emails will not contain clickable links and will not accept email responses. |
Beware of lookalike email addresses
|
| It’s important to note that the sending email address is often not visible on mobile devices [phones, tablets] without additional taps or clicks. |
| The sending email address is visible on desktops using Outlook for FASmail or the Outlook Web Application (OWA) when messages are viewed in the preview pane or opened. |
| Watch out for common errors within the content of the email [e.g. grammar and spelling]. |
| Take notice of the formatting of the message itself [e.g. messages that purport to originate from Workday but do not follow the standard Workday look and feel you are used to]. |
*Remember: “Think before you click”. If you have concerns about a Workday message or link, don't open the message or click the link. Forward it as an attachment to security@ubc.ca.
Next Level Assurance
We are pleased to provide a new measured level of assurance as we transition into the use of the Workday as UBC has worked extensively to ensure specific security controls are in place for the @workday.svc.ubc.ca domain. In time this same level of assurance will apply to other email domains as well.
You will frequently be asked to log into Workday using multi-factor authentication (MFA).
The use of MFA with Workday adds a second layer of confidence, knowing that your private information is secure. If you are ever concerned about the authenticity of a message that appears to be from Workday, don't open the message or click the link. Forward it as an attachment to security@ubc.ca.