RE: Victim’s Expense Reimbursement – Scam (3/12/18)

Today’s scam is a unique targeted phish (spear-phish) at someone who is not a member of our school but admin of another school. For this scam, the scammer impersonated a member of our school to request a money transfer to themselves. In this case, the person whom this email was sent to believe it to be suspicious, rightly so, and emailed the person it was impersonating asking to confirm. Once the impersonated person (hereby referred to as victim) received the email asking for confirmation, they emailed back that this was not them.

Because this phish is more complicated than a mass spam email, it can be more difficult to distinguish. One of the indicators that tipped off the recipient of the email that this email was not legitimate was the non-business mail (email was sent from a email address) and the poor grammar (lack of space after comma,”Here is” instead of here are, “once am back” instead of once I am back) and the fact that the person is requesting money via email instead of the appropriate channel for submitting reimbursement charges. Those are somethings that can tip you off that an email is a scam.

If you receive a suspicious email from someone that you know please check with them via Phone call or another email or any other method (besides emailing back the address!) If you do happen to receive this email please delete it!

From: VCU Victim []
Sent: Friday, March 9, 2018 3:15 PM
To: Other School Victim
Subject: RE: VCU Victim Expense Reimbursement

Other School Victim,Here is the details you need in mailing the check to the recipient. I would appreciate if you can make the payment Via USPS Express Mail Delivery. I will forward the receipt to you once am back from my trip.

Name: Axxxx Fxxxx
Address: 1xx 4th St
City: Gilmore City
State: Iowa
Zip Code: 50541

VCU Victim

Sent from my iPhone

*email has been edited to remove details of victims

Comments are closed.