Beware: Uptick in fraudulent emails asking for money or sensitive information

ITaP has received several reports of fraudulent emails that at first glance appear to be from a colleague or boss, but upon closer inspection are from non-Purdue email addresses, such as Gmail or Yahoo, made to look like they come from a Purdue employee.

These emails also may contain the email signature of the person who the scammer is trying to impersonate.

The messages typically make an urgent request for the recipient to purchase a gift card or other services and then provide the account numbers to access them. Additionally, scammers may ask for login information and other personal or sensitive data.

Technically, the email addresses in this scam are valid, so mail sent from these non-Purdue accounts will not be caught through anti-spam filtering. Because of this, it is important to review tips for catching phishing emails. Remember that any email requesting money, account numbers, other sensitive data or login information should be heavily scrutinized.

Purdue will never ask you for sensitive information via email and you should always check whenever you’re logging in to a website with your Purdue career account that the site is secure (https://) and that it is on the Purdue domain (purdue.edu).

Here are some tips and best practices to avoid getting scammed via phishing:

1. Check the domain of the sender’s email address. If it is not @purdue.edu, be skeptical. Keep in mind that often smartphone email apps only display the sender’s name by default, but not the full email address. For example, an iPhone requires you to tap on the sender’s name to reveal the full email address.
2. When in doubt, contact the purported sender of the message through another channel, such as by calling their office phone or visiting them in person. 
3. Finally, it is important to report any attempted scam to ITaP security by sending the email in question as an attachment to abuse@purdue.edu.

If you have questions or need assistance, you can call or email Tech Support at 49-44000 or itap@purdue.edu.

For more information about how to protect yourself from online scams, visit https://purdue.edu/securepurdue.

Writer: Kirsten Gibson, technology writer, Information Technology at Purdue (ITaP), 765-494-8190, gibson33@purdue.edu.

Last updated: October 16, 2018