Phishing Simulation Training For Faulty And Staff

Oops, you clicked.

This was a safe Pace University cybersecurity awareness exercise. No login information was requested or collected. Use this moment to learn how to spot a suspicious shared-document message.

Why you are seeing this page

You clicked a link in a simulated phishing email titled “Confidential Document Shared With You.” The message imitated a Microsoft SharePoint notification and used urgency, authority, and curiosity to encourage a quick click.

*If this had been a real attack, the next page could have attempted to steal your Pace credentials or deliver malicious software.*

The simulated email

Review the numbered warning signs. Each one is a reason to pause and verify before clicking.

Staff Phishing Email Simulation

Eight red flags

  1. Unexpected subject: You were not expecting a confidential document.
  2. Display-name trust: A familiar name does not prove who sent the email.
  3. Look-alike domain: The address is not an official @pace.edu or Microsoft notification address.
  4. Generic greeting: “Hello” does not identify the recipient.
  5. Vague authority: “University Administration” names no person or office.
  6. Artificial urgency: A deadline of “Today” pressures immediate action.
  7. Hidden destination: A button can conceal the actual website address.
  8. Credential request: The message prepares you to enter your Pace username and password after clicking.

Verify shared documents safely

  1. Pause. Do not use the email button if the shared file is unexpected.
  2. Inspect the full sender address. Do not rely only on the displayed name or logo.
  3. Check the destination. On a computer, hover over the button without clicking. On a mobile device, avoid pressing the link if the message is unexpected.
  4. Use a trusted route. Open a new browser window and manually visit the Pace Portal or your known Microsoft 365/SharePoint bookmark to look for the document.
  5. Verify independently. Contact the named sender or department using contact information you already trust, not information supplied in the message.

Important: Never enter your Pace password or approve an MFA prompt after following an unexpected email link. If an MFA request appears when you are not signing in, deny it and report it.

If this were a real suspicious message

  • Do not reply, click links, open attachments, or enter credentials.
  • Forward the suspicious email as an attachment to iso@pace.edu.
  • If you already clicked, entered information, downloaded a file, or approved an MFA prompt, contact the ITS Help Desk immediately.
  • Do not delete the message until Information Security or the ITS Help Desk advises you to do so, because the original message may assist the investigation.

Need help or want to report a message?

Information Security Office
Email: iso@pace.edu

ITS Help Desk
Phone: (914) 773-3333
Email: pacehelpdesk@pace.edu

Report Spam, Phishing, or an IT Security Issue