Over the past two weeks, two of the club’s email accounts have been compromised and used to send fake messages to a large number of contacts. If you have received an unexpected email from a club address asking you to open or view a document, please do not click on it.
What the latest email looks like
The most recent fake email, sent on Thursday 1 October, is designed to look like a Zoom Canvas document invitation. The subject line reads:
[Name] invited you to view “MoseleyRugbyFC Proposal”
It contains a blue “Open” button. There is no proposal – the button leads to a page designed to steal email login details.
What to do if you received it
- Do not click “Open” or any link in the email.
- Delete it from your inbox and your deleted items.
- If someone forwarded it to you, the same applies.
If you have already clicked the link
- If you entered your email address or password on the page that opened, change that password straight away, along with any other account where you use the same password.
- Turn on two-step verification (also called multi-factor authentication) for your email account if you can.
- Let your IT team or email provider know, especially if this is a work account.
What we’ve done
Both affected accounts have been secured, and we have written directly to everyone we know received the latest email.
We are now working directly with Microsoft to review our email security and put stronger protections in place, to stop this happening again.
We’re sorry for the inconvenience, and thank you to everyone who flagged these emails with us so quickly.
How to spot this kind of email in future
- Be wary of unexpected “document shared with you” emails, even from people or organisations you know – check with the sender by phone or text before opening.
- Before you click a link, hover over it (or press and hold on a phone) to see where it actually goes.
- A genuine sign-in page will never be reached from an email you weren’t expecting. If in doubt, go to the website directly instead.
If you have any concerns, please contact us at archie.yoxall@moseleyrugby.co.uk
