Beware of phishing attacks and other suspicious emails.
The University of Waterloo will never send you an email asking for personal information or passwords. Phishing emails are designed to steal your identity. They ask for personal data, or direct you to websites or phone numbers to call, where they ask you to provide personal information (such as name, address, account information, passwords, etc...).
See the Guidelines on Use of Email for more information and other recommendations.