Hooked: Investigating the Phishing Attack That Targeted Me at University
Phishing emails are everywhere. But what happens when you are the target? This presentation is about a real life phishing incident I experienced as a student at London South Bank University and the findings I uncovered during my investigation.I noticed some suspicious activity and rather than just delete it, I thought I’d dig a little deeper. I’m quite proud of what I uncovered about the spoofed sender, the social engineering tricks they employed and the infrastructure behind it all - which I reported to the university IT team.In this discussion we will cover how the phishing attack bypassed SPF, DKIM and DMARC, the investigation process using open source tools, subtle red flags that may be overlooked, and practical tips to detect and respond to phishing attacks.
On 1st May 2026, a phishing email landed in inboxes across London South Bank University. It demanded £850 in outstanding tuition fees, threatened litigation, and looked completely legitimate — complete with the LSBU logo and sent from a real student email address.
What made this attack particularly dangerous was that it bypassed all three email security protocols — SPF, DKIM, and DMARC all passed. Because the attacker had compromised a real student account with no MFA enabled, the system saw nothing wrong.
Rather than ignoring it, I investigated using free open-source tools:
WHOIS lookup revealed the domain chaddlaw.co.uk was created just 3 days before the attack
Sort code checker showed the "university" bank account was actually a Monzo account
Email header analysis traced the email to a Microsoft Azure server in Paris, France
Companies House confirmed Chadd Law does not exist as a registered company
The findings were documented and reported to the university Dean. This talk walks through the full investigation step by step, showing that you don't need special skills or expensive tools to uncover a sophisticated phishing attack — just curiosity and the right methodology.
I'm Prithika Gopinath, a BSc Computer Science (Hons) student at London South Bank University. I'm the Assistant Technical Lead of LSBUZeroDay, a student-led cybersecurity society, and I'm currently founding CyberWomen@LondonSouthBank — the first CyberWomen branch in London. I'm also a National Cyber & Forensics Alliance (NCFA) Ambassador and working towards my Certified Associate in Project Management (CAPM) certification. I'm passionate about digital privacy and security awareness, and this is my first conference talk!