A note for University of Waterloo retirees
Every fall, Canada geese return to the same ponds, fields, and nesting grounds they have always known. Even geese relocated away from familiar territory have been documented finding their way back. Biologists call this natal philopatry, and many retirees may recognize the feeling.
Though your career at Waterloo may have come to an end, the connections, experiences, and friendships built over the years remain. You are still part of the Waterloo community, and that sense of connection carries trust. Protecting the accounts connected to your Waterloo identity helps protect not only you, but the broader community as well.
This Cyber Awareness Month, our most recognizable and vigilant campus resident, the Goose, shares five things you can do this month to help protect your digital identity wherever your journey takes you.
1. Secure Your Account: Layer Your Defenses
GOOSE FACT: Canada goose nests are built in layers: a base of twigs, grass, and plant material, bound together and shaped into a cup, then lined with down feathers to insulate the eggs. Each layer does a different job. Remove any one of them and the nest is weaker for it.
Your account should be built the same way. No single safeguard does the whole job on its own, but layered together, they make your account very hard to compromise:
- Long, unique password (the twigs). Use a password or passphrase of 15+ characters. A passphrase made of several words is easier to remember and harder to crack. This is your structural layer, as length is the single biggest factor in resisting password-cracking attempts.
- Duo Two-Factor Authentication (2FA) (the mud and moss). Ensure Duo 2FA is active on your account. This is the layer that seals the gap. Even if a password leaks, it isn't enough on its own to get in.
- Password manager (the down lining). A goose's down lining insulates and protects its eggs from the outside world. In the same way, a password manager keeps your passwords protected and out of reach of attackers. It also generates strong, unique passwords, so you never have to reuse them.
Visit Passwords, Password managers, and 2FA best practices to learn more.
2. Someone Else Could Be Honking as You Right Now
GOOSE FACT: Canada geese know each other by voice alone. Inside a chaotic, honking gaggle, a gosling can pick its parent's call out instantly because in nature, that voice could only ever come from one goose.
Your WatIAM account works the same way in the Waterloo community. The name, history, and address; that's your honk. People hear it and trust it without a second thought.
Here's the part geese don't have to worry about: a human account can be taken over by someone else while the name, the history, and the address stay exactly the same. This is how Business Email Compromise (BEC) works: an attacker gains access to a real, trusted account, often through a stolen password or a phishing link, and then uses it to send messages as that person. No spoofing, no fake domain, no red flags to catch. The gaggle still hears a familiar honk. They just don't know the goose behind it has changed, and they respond to the request for a wire transfer, a gift card, or sensitive info exactly as they would if it really were their friend asking.
If you're not actively using your account, the safest move isn't to leave it dormant; it's to close it. An account no one is watching is exactly the kind of unattended signal that shouldn't exist. If you are using it, that's why you should secure your account with layered defences.
Request to close or deactivate your account →
3. Stay Vigilant and Honk for the Flock
GOOSE FACT: Canada geese never let the whole flock feed with its head down. While most of the gaggle eats, one or two geese act as sentries and stay upright and watching, rotating the job, so there is always a set of eyes on alert. The moment a sentry spots something wrong, it does not stay quiet hoping someone else will notice. It sounds off at once, and the whole flock reacts like one. Any Waterloo employee who has cut across Ring Road in April knows what comes next: lowered head, stretched neck, wings out, and a determined charge.
Retirees are a favourite target for a few specific scams:
- Grandparent and family emergency scams: A caller, text message, or video chat claims to be your child or grandchild in urgent trouble and needs money immediately. Scammers can now use AI-generated voices and deepfake videos to imitate loved ones. Consider creating a family password or phrase to verify a real emergency before sending money or sharing information.
- Investment and cryptocurrency scams: Be skeptical of any opportunity promising guaranteed returns, exclusive access, or pressure to act quickly. Before investing, speak with a trusted financial advisor or your bank. Remember: if it sounds too good to be true, it probably is.
- Romance, friendship, and companionship scams: Scammers spend weeks or months building trust before asking for money. Before providing financial help, talk to a trusted friend or family member. Remember: never lend or give money that you cannot afford to lose. Pressure, secrecy, or urgency are often signs of a scam.
- Community and social group scams: Fraudsters impersonate community organizations, charitable causes, churches, volunteer groups, clubs, or local events to solicit donations, sell fake tickets, or collect personal information. Before donating or providing information, contact the organization directly using a phone number or website you trust.
- Account verification emails: Messages claiming your Waterloo account, email account, bank account, or online service needs immediate verification. Be suspicious of messages threatening account closure or loss of access. The University of Waterloo will not ask you to verify your account by email. If action is required, access is typically restricted until you sign in through official University systems.
These scams succeed when we react automatically. The sentry goose's job is to notice something unusual before the flock acts. PAUSE gives you that same moment to investigate before you click, respond, or trust a message.
Before you click, pay, reply, approve a login, or share information, PAUSE:
- Pause before reacting to create space between the message and response.
- Awareness — notice the pressure or fear it's leaning on.
- Unpack it — does the sender, the ask, the timing add up?
- Select your next step — verify through a source you trust, not one it gives you.
- Escalate if it still feels off. Report it to the Security Operations Centre (SOC) right away. Follow these reporting steps.
Stay alert and protect what matters, like a goose defending Ring Road. Learn how to defend and respond to phishing at Waterloo.
4. Every Step Leaves a Track
GOOSE FACT: Geese leave tracks everywhere they go. In mud, snow, or sand, each footprint reveals where they've been, which direction they traveled, and often how long they stayed. Geese cannot avoid leaving a trail behind them. Instead, they protect what matters most by being cautious about what those tracks can lead back to.
The same is true online. Every post, comment, search, prompt, upload, account registration, and "like" leaves behind traces. Individually, these details may seem harmless. Together, they can reveal far more than you intended, helping criminals build convincing phishing attacks, guess security questions, impersonate you, or target the people around you.
Follow the Tracks You Leave Behind:
- Think Before You Post: Public posts can reveal your routines, interests, workplace, family members, travel plans, and other details that help attackers build a profile of you.
- Be Careful about What You Share with AI Tools: Prompts, uploaded files, and conversations may be stored or retained by the provider. If you would not post it publicly, do not paste it into an AI tool.
- Treat Security Questions Like Passwords: Answers such as your hometown, first school, or mother's maiden name can often be discovered from public information. Use unique, non-obvious answers and store them in a password manager.
- Regularly Review Your Digital Footprint: Search for yourself online, review old social media posts, and remove information that no longer needs to be public.
Just as a goose cannot stop leaving footprints, you cannot completely avoid leaving a digital trail. The goal is not to leave no tracks at all. The goal is to make sure those tracks never lead directly back to something an attacker can use against you.
Learn how to Protect personal privacy on social media platforms and Safeguards for working with AI tools.
5. Recovery: Know Your Way Home Before You Need It
GOOSE FACT: Canada geese navigate home using a combination of spatial memory, landmarks, the Earth's magnetic field, and learned routes passed down through the flock. They don't figure out the way back in the middle of a migration — the path is already mapped, rehearsed, and ready before they ever need it.
The same principle applies to account recovery. Set it up before anything goes wrong, not in a panic after it does.
To recover your WatIAM account password you need two things:
- your username; and
- access to an external email address Waterloo has on file for you.
Take a moment this month to make sure you:
- Remember your username. If not, use the "Forgot your username" link.
- Remember your password. If not, follow the WatIAM password reset instructions.
- Ensure your recovery email is current and accessible. It may be the personal email address you used when applying to Waterloo.
- Ensure your recovery email account is protected with a strong, unique password and 2FA. A weak recovery account can undermine your other security measures. If all else fails, contact the IST Service Desk if you no longer have access to your recovery email or can’t remember your username.
The Final Honk
Your account carries years of trust within the Waterloo community. Protect it, monitor it, or request its removal. This Cyber Awareness Month, make sure you are the only one who uses your voice in the Waterloo gaggle.
The Waterloo gaggle of Canada geese stay safe because no goose stops paying attention. Stay informed about new scams, emerging threats, and security advice from across the Waterloo community delivered straight to your inbox.
→ Subscribe to Honk If You're Secure!
GOOSE FACT: Want to learn more about the Canada Goose? See the Hinterland Who's Who fact sheet for nesting, honking, and navigation, and the Wildfowl journal study by Conover for natal philopatry.