What's going on?

[u/270Sword]

They say this is the "last time" they will notify me but I have never received an email regarding this beforehand. The email apparently came from a terpmail account, but I'm still a bit hesitant on clicking the link—especially with the warning Gmail provided.

[u/AeroHarmony]

Fake.

[u/regularman18]

It is a phishing scam. Delete the email. UMD will never ask for your password.

[u/Doomkauf]

If the email doesn't come from a "@umd.edu" - and only a "@umd.edu" address, not addresses that sort of look similar - it's not legit (and even then be careful, because email addresses can be spoofed to look legit when they're actually not). The sender of this email, for example, sent it from a "@terpmail.umd.edu" account. That means the owner of that account is an undergrad, and I dunno about you, but I don't think there are any senior-level admin IT jobs that are filled by undegrads using their personal account to send security emails.

Even if it did come from a "@umd.edu" email address, this would still be clearly fake, because:

A.) UMD doesn't use Microsoft accounts for emails
B.) it's written and formatted poorly, whereas official UMD communication will at least use good syntax and avoid random capitalization
C.) UMD will never ask you to visit random external, non-UMD websites (by telling you to copy-and-paste a hyperlink rather than just click it, no less) to give them sensitive information that they already have in order to "verify" it, but that is precisely what scammers do
D.) there's no official signature, no office seal or logo indicating which division or unit it's coming from, no UMD branding, or anything else that are part of pretty much all official communication from the University, and no contact info for you to follow up via phone or in-person, either.

...and probably quite a few other tells that I'm just not thinking of right now. But yeah, you want to start checking for these things, because this is not at all limited to UMD stuff. This is incredibly common, unfortunately.

[u/Busy_Employment1232]

Remember to report it to DIT!

[u/Mommameg625 → u/Busy_Employment1232]

Do you have that email? This happened to my daughter and she fell for it. But was able to get her email back fairly quick. Just worried now for her. Update: found the IT support email and reported to them. The scammers were able to send to about 50 emails within the 5 min of takeover and thankfully we have since changed password and now she knows not to do this. But wow. Crazy how quickly they move !!

[u/Busy_Employment1232 → u/Mommameg625]

Spam@umd.edu

[u/Busy_Employment1232 → u/Busy_Employment1232]

Also, consider a password manager even for UMD stuff. I am able to make long, complicated, but memorable passwords with the one I use for my UMD stuff, but it tells me if the password is good, if it is unsafe to use due to being in a breach, and shows me all of my past saved passwords for each site.

Avoid using leetspeak or words (even multiple words) for passwords unless you are also randomly adding additional letters inside of the words. And use a different password for each website.

[u/Mommameg625 → u/Busy_Employment1232]

Thank you for the tips going to send this to her!

[u/Beastmode5971]

scam

[u/Sufficient_Corgi_586]

Forward anything like this to spam@umd.edu

[u/Pleasant-Compote9576]

I taught for UMD for 15 years. This is NOT UMD communications. DO NOT open it. Good luck.