Skip to Main Content

University of california Incentive Payout Plan and Qualification Rules Ref: 0513901805982

UCLA Information Security Office is seeing phishing messages that arrive with no text in the email body and include a Word document attachment containing a QR code. The document claims to be a “Payroll Bonus / Remuneration Overview” and urges recipients to scan the QR code to view a confidential payroll summary. Scanning the code redirects to a credential-harvesting site that looks like an HR/login page. This is a phishing attempt to steal UCLA credentials.

What to watch for

  • Email arrives with an empty body and a single .docx / Word attachment.
  • Attachment text like “Payroll Bonus, Remuneration Overview – September 2025” or “Your updated compensation summary is now available.”
  • The document instructs you to scan a QR code with your phone to view payroll/benefits — or to “log in through the secure portal” via the QR link.
  • Redirects to pages that mimic UCLA/HR login screens and request your UCLA username and password.

What to do

  • Do not scan QR codes or open links in unsolicited attachments.
  • Do not enter your UCLA credentials on web pages reached from email QR codes or unfamiliar links.
  • Use Report Phish in Outlook or forward the message as an attachment to security@ucla.edu.
  • If you scanned or entered credentials: immediately change your UCLA password and contact the IT Security team.
  • Verify all HR/payroll communications on official UCLA HR portals or by contacting HR directly — UCLA will not ask you to scan a QR code in an unsolicited email to access payroll.

If you need help or believe your account was compromised, contact the IT Security team right away at security@ucla.edu

Subject: University of california Incentive Payout Plan and Qualification Rules Ref: 0513901805982

Body: The body of the email is blank but has a Word document attached:

 

Payout1

Word document:

Payout2

Payroll Bonus, Remuneration Overview – September 2025

Your updated compensation summary is now available.

Dear USER

We’ve completed the latest payroll and remuneration review for the current quarter. Your updated compensation details, including applicable changes, are now accessible via the secure portal.

You can access your September 2025 summary directly by scanning the code below or logging in through the usual HR portal.

With your phone camera, scan the QR Code to review & access full HandBook and Benefits details: 

After reviewing, please complete any required acknowledgments and provide your electronic signature where indicated. This ensures a seamless transition to the updated benefits program for 2025. 

⚠️ The information contained in this Handbook is confidential, and is intended solely for the use of the named addressee []. No other person is authorized to access, scan, or re-use this Handbook (or any information contained herein). 

Report Scams 

If you receive a suspicious email, do not click on any links, open any attachments, scan QR codes, send payment, or supply any credentials. Please do not reply to the email and immediately contact security[@]ucla.edu and report it to your IT team.

Tags
Email Phishing