[CITL] Alert: Suspicious WEX e-mail - Discovery Benefits Account

[Dewight F Kramer]

Hello CITL,

There is an email that that staff members at multiple UC  locations are receiving emails from: Auto_Reply at mailer.discoverybenefits[.]com<mailto:Auto_Reply at mailer.discoverybenefits%5B.%5Dcom>
The subject line is “Recent Update to your Discovery Benefits Account”

The body e-mail looks like:
[cidimage003.jpg at 01D7A4C6.7C955400]


There is an active inquiry underway at UCOP.  At the moment it is believed to be a data feed issue. Wex and UCOP are continuing to investigate  and looking to correct the feed and will send out a communication.   We are informing you so you are aware that Wex is a legitimate service that UC uses and it is possible that some of your people have received this email.  The ISO will update the below web page with more information as it comes in.
https://its.ucr.edu/iso-alert/2021/09/08/wex-email-about-address-changes


Thank you,


Dewight Fredrick Kramer
Chief Information Security Officer
Information Technology Solutions
University of California, Riverside
•  (951) 827-3070| • dewight.kramer at ucr.edu<mailto:dewight.kramer at ucr.edu>
[cidimage001.png at 01D7425D.25491FE0]


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ucr.edu/pipermail/citl/attachments/20210908/1bc21a27/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 23530 bytes
Desc: image001.jpg
URL: <https://lists.ucr.edu/pipermail/citl/attachments/20210908/1bc21a27/attachment-0001.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 10538 bytes
Desc: image002.png
URL: <https://lists.ucr.edu/pipermail/citl/attachments/20210908/1bc21a27/attachment-0001.png>