Annotations
This phish typically originates from a non-Cornell account. The sender may appear as " Cornell Payroll UPDATE <email@cadgrafics.com.mx> ". The QR code directs to a fake login page. Do not scan the QR code nor reply to the sender. If you entered your credentials into the page change your NetID password immediately at https://netid.cornell.edu
