Body
How to spot a fake VCCS email (and keep your account safe)
Why this matters
Scammers regularly send fake emails pretending to be from your college or the VCCS IT department. Their goal is to trick you into giving up your password, student ID, or personal details.
Here is a quick guide to help you spot phishing attempts and protect your account.
4 Big Red Flags: What we will NEVER ask you to do
No matter how official an email looks, treat it as a fake if it asks you to do any of the following:
-
Reply with personal info: We will never ask for your password, Social Security number, date of birth, or login details via email.
-
Log in through a Google Form: We will never ask you to enter your username and password into a Google Form or third-party web form.
-
"Verify" your account under threat: We will never threaten to immediately delete or freeze your account if you don't click a link to verify it.
-
Act immediately without time to think: Scammers use high-pressure deadlines (e.g., "Your account will be terminated in 24 hours!") to force quick mistakes.
Rule of thumb: If an email demands your password or creates panic, do not click, reply, or enter any information.
Check where the email actually came from
Display names can easily be faked. Always check the real email address behind the name:
-
Look for your college's official domain: Legitimate emails from your school come directly from your college's official .edu domain address.
-
Watch out for @email.vccs.edu: Official administrative notices do not come from generic @email.vccs.edu addresses.
-
Hover or tap: On a phone or webmail, tap or hover over the sender's display name to inspect the full email address. If it looks misspelled or unusual, flag it.
Example of a legitimate email
Not every email that explains a change to your account is fake. For example, if you leave or have not yet enrolled in classes, VCCS eventually moves your account into an Alumni status. Before that happens, you get a heads up email explaining the change, something like a notice that your account will lose access to certain student discounts and services in 30 days, along with suggestions for backing up your data if you want to keep it.
A real email like this has a few things in common that separate it from phishing:
-
Explain a clear policy change without demanding that you "prove" your identity.
-
Link to official tools (like Google's official data export page), not suspicious login forms.
-
Give you reasonable time to act (such as a 30-day notice) rather than a panic-inducing 2-hour deadline.
-
Include verified support contacts pointing directly to official help desk resources.
If the official emails that we usually send need to change
If the emails VCCS ITS or your college typically send to students ever change, we will document those changes on this page. If you see an email that does not match what is described here, treat it with caution.
What to do if you spot a suspicious email
-
Do not click any links or open any attachments.
-
Do not reply or submit any forms linked in the message.
-
Report it in Gmail: Click the three vertical dots next to the reply button in Gmail and select Report Phishing.
-
Notify IT: Forward the email to your college's IT Help Desk or the VCCS ITS Service Desk.
-
Delete it from your inbox once reported.
What if you already clicked a link or entered your info?
Don't panic, but act fast:
-
Change your VCCS password immediately.
-
Contact your college's IT Help Desk or the VCCS ITS Service Desk right away so they can help secure your account.