Report Suspicious Email: Forward It as an Attachment

If you receive a suspicious email in your CSUN account, send it to abuse@csun.edu as an attachment. This gives CSUN Information Security and IT Help Center the original message details needed to investigate phishing, spam, spoofing, malware, and account-compromise attempts.

Before you report:

  • Do not click links, open unexpected attachments, scan QR codes, reply to the sender, or approve unexpected MFA prompts.
  • If the message appears to come from a professor, supervisor, department, vendor, or campus system, verify it using a phone number, website, or contact method you already know is legitimate.
  • If you already clicked, replied, entered a password, approved MFA, or scanned a QR code, contact the IT Help Center right away.

Why send the email as an attachment?

Forwarding a suspicious email as an attachment preserves the original email headers. Headers include technical details about the sender, route, and authentication checks that help Information Security determine where the message came from and whether other campus accounts may be affected.

A normal forward, screenshot, or PDF can be useful for context, but it is not enough for a full investigation because it may omit or change the original header information.

If you already clicked, replied, entered information, or approved MFA

  1. Stop using any links or phone numbers from the suspicious message.
  2. Change your CSUN password from a trusted CSUN page or contact the IT Help Center for help.
  3. Contact IT Help Center at (818) 677-1400.
  4. Tell IT Help Center what happened, including whether you entered a password, approved an MFA prompt, scanned a QR code, opened an attachment, or sent money or gift cards.
  5. With IT Help Center, review suspicious inbox rules, forwarding settings, sign-in activity, and MFA devices.

Common higher-education phishing themes

Be especially cautious with messages about:

  • Campus jobs, research assistant roles, internships, or checks.
  • Gift card requests from a professor, supervisor, dean, or department leader.
  • Financial aid, tuition, payroll, direct deposit, tax forms, or refunds.
  • MFA resets, account verification, storage quotas, password expiration, or QR codes.
  • Shared files, Canvas, Zoom, Microsoft 365, Google Workspace, Box, or DocuSign-style requests.

Messages from a real CSUN account can still be unsafe if the account has been compromised. When in doubt, report it.

Use this option for CSUN Microsoft 365 mail.

  1. Start a new message addressed to abuse@csun.edu.
  2. Use a clear subject, such as Suspicious email report: [original subject].
  3. Keep the suspicious message visible in the message list. In Outlook on the web, open the compose message in a separate window if needed.
  4. Drag the suspicious message into the body of your new message. Confirm that it appears as an attached email file, such as an .eml item.
  5. Add a short note explaining why the message looks suspicious and whether you interacted with it.
  6. Send the message.

  1. Select the suspicious message in your message list.
  2. On the Outlook ribbon, select More Respond Actions, then select Forward as Attachment.
  3. Address the new message to abuse@csun.edu.
  4. Add a short note explaining why the message looks suspicious and whether you interacted with it.
  5. Send the message.

If the menu is not visible, create a new message and use Attach File > Attach Item > Outlook Item, or use Outlook on the web.

Outlook for Mac changes over time, so the most reliable option is Outlook on the web from a computer. If you are using the Mac app:

  1. Start a new message addressed to abuse@csun.edu.
  2. Try right-clicking or Control-clicking the suspicious message and selecting Forward as Attachment, if available.
  3. If that option is not available, drag the suspicious message into the new message and confirm it appears as an attached email item.
  4. Add a short note explaining why the message looks suspicious and whether you interacted with it.
  5. Send the message.

Use this option if your CSUN email is in Gmail or Google Workspace.

  1. On a computer, open Gmail.
  2. In the message list, select the checkbox next to each suspicious email.
  3. Select More, then select Forward as attachment.
  4. Address the message to abuse@csun.edu.
  5. Add a subject and a short note explaining why the message looks suspicious and whether you interacted with it.
  6. Send the message.

Some mobile mail apps do not provide a reliable "forward as attachment" option. If you do not see the option, use Outlook on the web or Gmail from a computer.

If the issue is urgent or you only have mobile access, send what you can to abuse@csun.edu and include the app and device you used.

What to include in your report

Include:

  • The suspicious email attached as an original email item, when possible.
  • A short note about what made it suspicious.
  • Whether you clicked a link, opened an attachment, replied, entered credentials, approved MFA, scanned a QR code, or sent money or gift cards.
  • The campus role affected, if relevant: student, faculty, staff, applicant, alumni, vendor, or guest.

Do not include:

  • Your password or MFA code.
  • Social Security numbers, banking information, or payment card details.
  • Screenshots as the only evidence, unless you cannot attach the original message.