The UofT I+TS Security Group has asked that people be reminded that UofT (and also the Department of Mathematics) will never ask for someone to send a password via email (unless that email is well encrypted, and currently most people still do not use that). They have a warning page for avoiding email and phishing fraud.
Also, the main UTORweblogin page (to access the Portal for Blackboard, for example and UofT’s webmail) has a large box with an anti-phishing warning to remind people to not type passwords into the wrong web pages.