Beware of phishing attempts impersonating UC Davis Health executives

UC Davis Health recently identified two phishing attempts targeting employees by impersonating one of our executives. In these cases, attackers used email and text messages to request payment for an invoice.

These messages were not legitimate.

Cybercriminals often impersonate senior leaders to create urgency and pressure employees into acting quickly. Knowing what to look for—and what never happens at UC Davis Health—can help protect you and our organization.

A critical reminder

UC Davis Health executives will never:

• Email or text employees to request that they purchase items or pay invoices.
• Request payments that fall outside established business and purchasing processes.
• Request gift cards, prepaid cards or personal reimbursements.

If a message asks you to do any of these things, it is a scam.

Common red flags to watch for

Be careful if you get a message that contains any of the following:

• A sense of urgency, secrecy or pressure to act immediately.
• Requests to pay an invoice, purchase items or transfer funds.
• Instructions to bypass normal channels or approvals.
• Requests sent via text message or from a personal-looking email address.
• Spelling, grammar or formatting that feels slightly “off.”
• A sender name that looks familiar, but the email address or phone number does not.

Even if the message appears to come from a known leader, pause and verify.

What to do if you receive a suspicious message

• Do not respond, click links or send money.
• Do not reply by text or email to “confirm” the request.
• Report the message immediately using the Report Phishing button in Outlook, or follow your department’s established reporting process.
• If you’re unsure, contact IT or Information Security before taking any action.

Quick reporting helps protect colleagues and allows IT teams to block similar attempts.

When in doubt, trust your instincts

If something feels unusual, rushed or out of character for how UC Davis Health operates, it probably is. Executives understand and expect employees to verify requests — and they would much rather you pause and check than take a risk.

Remaining alert helps keep our patients, colleagues and systems safe.