EFT/ACH Payment Remittance Advice For Cornell (PAID IN FULL)
This phish typically originates from a non-Cornell account. The sender may appear as "Accounts payable Cornell <[user]@canpaint.com>". The link within directs to a fake login page. If you entered your credentials into the page, change your NetID password immediately at https://netid.cornell.edu.