IT Security: Simulated Phishing Email Campaigns

What Is Phishing?

Phishing is a cyberattack that attempts to trick individuals into handing over personal information to cybercriminals.

This information may include login credentials, banking details, credit card numbers, and other sensitive data. Phishing attempts typically arrive through emails or text messages.

Cybercriminals may pose as someone from Okanagan College, a trusted vendor, or a reputable company to convince you to click a malicious link. While the link may appear legitimate, its real purpose is to steal your personal information or install harmful software on your device.

What Is the Purpose of Simulating These Campaigns?

IT Security conducts simulated phishing campaigns as part of our mandatory cybersecurity awareness program for all employees at Okanagan College. These exercises are designed to help employees recognize suspicious messages and become more vigilant when identifying potential threats.

What Happens if I Fall for These Simulated Phishing Emails? Will I Be in Trouble?

You will not be in trouble. These exercises are designed to help you learn how to recognize phishing attempts in a safe environment, without any real‑world consequences. Your participation and results are extremely valuable to help us assess the potential likelihood and impact of real threats, and it enables us to refine and optimize how we deliver cybersecurity awareness training.

You’ll receive a notification letting you know that you clicked on a phishing simulation conducted by IT Security. You will then be sent a few short training videos to help reinforce how to spot suspicious emails. These training messages will come from notification@attacksimulationtraining.com, a legitimate Microsoft‑provided training service.

Report or Verify Phishing Emails

Reporting suspicious emails helps us identify potential threats and protect the entire Okanagan College community from phishing attempts and malware.

How To Report Phishing Emails:

These steps are the same for the New, Classic, and Online version of Outlook.

  1. Open Outlook and go to your Inbox.
  2. Select the suspicious email (do NOT click links or attachments).
  3. On the top ribbon under the Home tab, click the Report button.
  4. A confirmation box will appear, select Report to finish.
Button for reporting phishing emails in Outlook with the confirmation window underneath.

How To Verify if an Email Is Phishing:

If you are unsure whether an email is malicious or not, please forward it to ITSecurity@okanagan.bc.ca and we will confirm that for you as soon as possible.

Recognizing Phishing Emails:

Imagine that the email below has just arrived in your inbox. Before scrolling down to see the answers, take a moment to review it and see if you can identify any signs that it might be a phishing attempt.

An example of a phishing email from someone impersonating Amazon.
An example of a phishing email from someone impersonating Amazon with important indicators highlighted, proving why it is a phishing email.

Did you catch them all? These indicators are explained in more detail below:

Check sender's email address:
  • Always check the sender’s email to confirm it is from a legitimate source.

Protect Yourself Further

Enable passwordless authentication: Take advantage of passwordless sign-in methods such as passkeys through the Microsoft Authenticator app or FIDO2 security keys. By removing the need to enter a password, you significantly reduce the risk of it being captured through phishing or fake login pages, making it much more difficult for cyber criminals to gain access to your account.

Set Up Passwordless Authentication with a Passkey

  1. Go to: https://aka.ms/mysecurityinfo
  2. Sign in using your Okanagan College credentials.
  3. Select Add sign-in method.
  4. Choose a passkey-enabled option such as Passkey in Microsoft Authenticator or Security Key.
  5. Follow the prompts to complete setup on your device.
  6. Set your new method as your default sign-in option.

Additional Common Questions:

No. These simulations are intentionally designed to resemble real phishing emails as closely as possible, and there is still a significant chance that what you’ve received could be an actual phishing attempt. Please report it by following the steps outlined in the Report or Verify Phishing Emails section above.

No. Unfortunately, cybercriminals continue to get more sophisticated, and the tools they use to create convincing malicious emails are improving as well. That’s why it’s essential to stay up to date with regular training to stay ahead of the curve.

If you would like to learn more about phishing, please view IT Security's guide for outsmarting cyber baddies or see Microsoft article below. You can also email IT Security for any questions or concerns regarding our phishing campaigns or phishing emails in general, and we will get back to you as soon as possible.

Microsoft Article on Phishing IT Security's Guide for Outsmarting Cyber Baddies
Email IT Security

Under normal circumstances, no. Your individual results on interactions with a phishing simulation email will be kept confidential by the IT Security Team. Assigned training status/completion will be tracked and recorded for compliance reporting. In limited circumstances, such as repeated high-risk behaviour or where required by College policy, relevant information may be shared with appropriate leadership.