Recognize scams: 8 pitiful phishing attempts sent to Sac State students
Scams offer fake jobs and laughable typos
Collage of phishing scam emails sent to Sac State students. Sac State Information Resources & Technology warned students of a spike in phishing attempts in a SacSend email sent on April 24.
May 4, 2020
Sacramento State students have been hit with some new phishing scam emails recently, a common occurrence for students.
Sac State Information Resources & Technology warned students of a spike in phishing attempts in a SacSend email sent on April 24. The email warns students of two new phishing scams: one threatening to close Microsoft Office 365 accounts and another offering fake part-time jobs. Other phishing scams IRT warns of include IRS tax scams, COVID-19 stimulus payment scams and fake voicemail attachment scams.
Marc Fox, IRT interim information security officer and senior director for enterprise systems, said there have also been recent scam emails from Gmail accounts using the name of a dean or a director on campus. Fox said with people at home and federal CARES Act funds disbursements upcoming, they expect to see increased phishing activity.
“We’re particularly vulnerable now under the current situation with schools doing distance learning and with CARES,” Fox said.
RELATED: FAQ: What you need to know about Sac State’s emergency financial aid grants
Brad Grebitus, IRT desktop and client security lead, said phishing is an attempt to get people to give away credentials, sensitive information and money. Phishing scams try to extract cash from students and get access to personal emails or My Sac State credentials.
Although there are some sophisticated emails, there are others that contain typos or grammar errors as well as ridiculous job offers and requests that make them obvious scams. Fox said he believes some are more laughable in their attempts.
“There are some that come through that I would classify as lame,” Fox said. “It almost seems like it is a lazy effort.”
IRT announced a new “Cofense PhishMe Reporter” button in another SacSend email sent on April 27 that provides students a fish-shaped button built into the Outlook menu that automatically generates a report to the IRT Information Security Team when clicked. Students can also still report phishing by sending any scam emails they receive to [email protected].
Fox said they also encourage students to enroll in two-step verification with Duo to require both a SacLink login and confirmation from an app to verify identification.
Grebitus said phishing scams try to get an emotional response out of people to get them in a rush. To recognize a scam email, he said students should think about what the email is asking for.
“Take a look at each message that comes through and inspect it,” Grebitus said. “Take that time to inspect and think about it.”
Grebitus said to hover your mouse over any hyperlinks to see where they will actually send you to. He said to look at the email address of the sender to see if it is legitimate. Sac State communications only use csus.edu addresses, he said. People can also look at the header of an email and check the format for official branding. If there is a link to My Sac State, he suggests going directly to the website instead of clicking it.
To help students recognize what scam emails look like, and how laughable some can be, The State Hornet compiled eight examples of scams that were sent to the Sac State community:
1. A high-paying, “100% legit” part-time job offer you can’t pass up.
2. Another job offer and a spoofed email address.
3. “You recently made a request to terminate!!!”
4. Why is Joel doing his research project at 4 a.m.?
5. A personal assistant to “purchase the toys.”
6. I need a dog sitter. I guess I’ll email all of Sac State.
7. “Unique and fun,” you say?
8. An example of a fake scam sent by Sac State as part of the IRT Cofense PhishMe program. Fox said IRT sends emails once or twice a year that look like phishing to help students recognize scams and teach them on how to avoid them.
