CONGRATULATIONS! [Student grant scam]

This grant scam impersonates a Canadian non-profit research organization and specifically targets UVic students by claiming to offer monetary grants to students. The attachment even includes MITACS and UVic logos to make the offer look more legitimate. However, there several signs that this is a scam:

  • The email came from a Gmail address–UVic or MITACS would send real grant notices from their organizational email email addresses, not using a free email provider.
  • The email says you were specifically selected based on your performance, but the email is addressed impersonally.
  • The formatting issues within the email and missing signature block give it a less-than-professional look.
  • The attachment directs you to apply by contacting a phone number with an American area code. If you are told to apply by SMS, it’s probably a scam. It also uses language that creates a sense of urgency to get you to act hastily.

If you replied to the scammer, contact the Computer Help Desk or your department’s IT support person immediately for assistance.

Grant scam email

From: MITACS GLOBALINK <o*******2001@gmail.com>
Subject: CONGRATULATIONS!

Attachment: [PDF] MITACS STUDENT GRANT SCHEME.pdf

You don’t often get email from o*******2001@gmail.com. Learn why this is important

 

MITACS STUDENT GRANT SCHEME

To whom it may concern We are delighted to offer you a grant to support your academic, personal use and research endeavors at University of Victoria (UVic).

You were selected based on your academic performance and potential to make meaningful contributions in your research aspect.

Find the attached details,

Piano and welder scams impersonating real people from UVic

Piano and welder scams are two variations of the same tactic: the scammer claims to offer a large valuable item for free, but then tells anyone who replies that they’ll need to pay to have the item shipped from out of town. At that point, the scammer will provide an email address for a supposed moving company, which will often be from a free email provider like Gmail or Outlook (not exactly a professional look!). That moving company will turn out to be fake–if you contact them to make arrangements and pay them money, you’ll never hear back from them again and never receive the item you were expecting.

The latest batches of these scams are impersonating a real person from UVic to make the offer look more legitimate. Check the sender information and reply address carefully; if the email was sent from or tells you to reply to a non-UVic email address, in all likelihood it’s a scam and not actually from the person it claims to be from. The fact that you are told to reach out using your personal email is another bad sign; that is a common trick used by scammers to move the conversation away from UVic’s monitoring.

Also, in the examples below, the faculty or staff member who is supposedly giving away the piano or welder is actually fictitious. The poor grammar is an additional red flag.

Piano scam impersonating a real person from UVic, containing photos of a Yamaha baby grand piano.

From: [redacted] <[redacted]@optonline.net>
Subject: FREE PIANO DONATION.!!!

Attachments: [three photographs of a black Yamaha baby grand piano sitting on an ornate rug]

You don’t often get email from [redacted]@optonline.net. Learn why this is important

Dear Student/Staff/Faculty,

One of our staff, Mr. Mark Gary is downsizing and looking to give away his late dad’s piano to a loving home. The Piano is a 2014 Yamaha Baby Grand size used like new. You can write to him to indicate your interest on his private email ([redacted]@writeme.com)to arrange an inspection and delivery with a moving company. Kindly write Mr. Mark via your private email for a swift response.

Best regards,

[redacted]
University Advancement
[redacted]@uvic.ca
University of Victoria
https://www.uvic.ca

Welder scam impersonating a real person at UVic

From: [redacted] <[redacted]@gmail.com>
Subject: Disposal Of Welding Machine And Tools Box

You don’t often get email from [redacted]@gmail.com. Learn why this is important

Dear Student/Faculty And Staff,

One of our staff at University of Victoria Ms Mary Figuerova, Assistant Professor. is downsizing and looking to give away her late dad’s Miller 951937 Dynasty 300 TIG Welder w/ TIGRunner Pkg & Wireless Foot Control, With A Complete Set Of Snap On Tools Box And Accessories.
If interested in any of the equipment  kindly indicate by sending her a mail via your personal email for a swift response.
to indicate your interest in any of the listed items contact her on her private email address ([redacted]@outlook.com) to arrange delivery with a moving company.

Sincerely,

[redacted]
Member Of The Board
University of Victoria

October 2024 Staff Report and lndividual Assessment

Phishers often try to create a sense of urgency to get people to click the link in haste, and that tactic is on full display in this fake HR email. If you receive an email that claims to be from HR, especially one that seems urgent or feels intimidating, first take a few deep breaths, and then look closely at the email to see if there are signs that it’s fake. This one has quite a few red flags:

  • The email did not come from UVic (in fact, the phisher appears to be abusing a compromised account at another university). A real UVic HR email would come from a UVic email address.
  • The email was sent to hundreds of people, many of whom were not from UVic. That is a strong sign that this is a non-targeted mass phishing email and not a genuine HR notification.
  • The greeting is impersonal, there is no signature block, and the email doesn’t specifically mention UVic.
  • Hovering over the link will reveal that it does not go to a page from UVic; it actually goes to a page from a free online form builder.

Fake "urgent" HR email that is actually phishing

From: [redacted]@********t.edu
To: [redacted] + 397 more
Subject: October 2024 Staff Report and Individual Assessment

You don’t often get email from [redacted]@********t.edu. Learn why this is important.

Assessment Dear Team,
I am pleased to inform you that the HR Department has recently finalized the Staff Report for October 2024.  It is imperative that you treat this matter with urgency.

Attached below, you will find the relevant file that contains your individual Assessment Report. Please open it to access the information

Click Here [link] To View Report

Thank you for your prompt attention to this matter.

Student Job Opening

Once again, job scammers are impersonating real UVic professors to target students in need of extra funds to pay for tuition and other necessities. This latest batch isn’t as elaborately written as the last one posted here, but still has some of the usual red flags:

  • The email came from a Gmail address. If a job offer comes from or tells you to contact an address from a free email provider like Gmail or Outlook.com, it’s extremely likely to be a scam.
  • The name of the sender does not match the signature block. Inconsistencies like that can be a sign that something is not right with the email.
  • The scammer may be trying to create a false sense of urgency by saying a student is “urgently required” to trick you into replying hastily.
  • The salary is too good to be true–$320 per week for only 8 hours of remote work is well above the typical wage for co-op or other student jobs.
  • Although there are no glaring grammatical errors, the wording still comes across as stilted and awkward.

If you replied to the scammer, cease contact and reach out to the Computer Help Desk or your department’s IT support person for assistance.

Job scam impersonating a professor from the Biology Department

From: P***** C***** <[redacted]@gmail.com>
Subject: Student Job Opening

You don’t often get email from [redacted]@gmail.com. Learn why this is important.

The service of a student is urgently required to work part-time as a student administrative assistant in the Department of Biology and get paid $320 weekly. This is a remote opportunity and work time is 8 hours in a week.
To apply, please submit your resume to the Department of Biology via this email address to proceed.

Sincerely
Dr. ****** B*****
Professor
Department of Biology
Office: CUN ****

“Dear Qualified Student”, “GRANT” or “10/21/2024” scam emails

Job scams aren’t the only way that scammers try to take advantage of students in financial need–they are also sending out scam emails claiming to offer grant money. In this case, the tantalizing offer of a few thousand dollars that don’t need to be paid back is very likely to be a pretext for a cheque overpayment scam.

Notice how the email says you are supposed to use almost half of the funds for “humanitarian service for a disabled student”. In all likelihood, that means that the scammer will tell you to cash the cheque and then send some of the money to another person or bank account specified by the scammer. A few days after you do that, the cheque will bounce and the money you transferred will effectively come out of your own funds, meaning you’ll have lost a non-trivial amount of money. (Also, the scammer’s math doesn’t add up; $2700 + $2200 = $4900 and that’s more than the amount on the cheque!)

In addition to the above, there are many other red flags:

  • The email was not sent from UVic, a provincial government (such as gov.bc.ca), or the federal government (canada.ca or something ending in gc.ca).
  • You are told to apply by emailing an Outlook.com email address. If you are told to contact an address from a free email provider, the grant is very likely to be a scam.
  • The scammer wants you to reply from your personal email and provide your mobile phone number. Scammers use this tactic to move the conversation away from UVic’s monitoring and security controls.
  • The scammer also asks you to email other personal information like your address and where you bank.
  • The greeting is impersonal.
  • The email contains awkward wording and grammatical errors.
  • The signature of “Canada Student Grant” is vague/generic and does not mention UVic or a specific government department.
  • While the message looks like normal text, the whole thing is actually an image–that’s a strong sign that the message is not legitimate and the scammer has done that to evade spam filters.

If you replied to this email, cease contact with the scammer and reach out to the Computer Help Desk immediately for assistance.

Student grant scam email that is likely to be a cheque overpayment scam

From: [redacted]@[redacted].net
Subject: Dear Qualified Student

You don’t often get email from [redacted]@[redacted].net. Learn why this is important.

Dear Qualified Student,

Your 2024 Grant has been approved and payment check is ready for immediate disbursement

Take note this is a grant, and you’re not obligated to pay back. We believe this will help students in containing educational fees and personal bills.

The payment will come via Check for MOBILE DEPOSIT, and this is because of theft and loss of pay checks in the mail delivery by Canada Post, UPS/FedEx etc.

The grant board will issue you a check of $4,700.00. However, your approved grant amount is $2,700.00 and $2,200.00 slated for you to carry out a humanitarian service for a disabled student whose details will be sent to you once the grant funds have been made available. This is a general outreach to support students and to also support other disabled/less privileged individuals within the student Community.

Kindly reconfirm the below to begin the immediate claims process.

Full Names:
Mobile Number:
Address (Postal code included)
Specify name of Bank (TD, RBC, BOM, CIBC SCOTIA ETC)
Age:
Personal email:

Important Note: you are to contact the claims officer Mr Neil Trotter on ([redacted]@outlook.com) and your email to him must come from your personal email account (Gmail, Yahoo, Hotmail, iCloud etc) and not your school email. Failure to comply to this simple instruction means your eligibility for this grant will be disregarded.

Contact Person: Neil Trotter
Contact Email: [redacted]@outlook.com

Only send application to the above email address [redacted]@outlook.com

I await your prompt response.

Regards,
Canada Student Grant

Research Assistant Position

Like we’ve seen many times before, job scammers are impersonating real UVic professors or staff and targeting students looking for extra income to help pay for essentials when the cost of living remains so high. This latest batch is more elaborately written than many of the previous ones we’ve seen and may have been composed with the help of generative AI. Despite that, many of the typical red flags are still present:

  • The email came from a Gmail address and instructs you to apply by contacting a separate Mail.com address. If you receive an unsolicited job offer where either the sender or the reply address are from free email providers, it’s probably a scam.
  • The salary is too good to be true–$350 per week for only 6-7 hours of remote work is well above the typical wage for co-op or other student jobs.
  • The scammer requests your phone number, which may be a ploy to move the conversation away from email to evade our security controls.
  • There are still a few errors in the message text, such as incorrect capitalization, awkward wording, and the lack of a name in the signature block.

If you apply for a job and are told you were the successful candidate without going through an interview or otherwise meeting your employer first, it’s very likely to be a scam. And if you are told to buy and send gift cards or transfer money to someone else, definitely do not proceed!

If you replied to the scammer, cease contact and reach out to the Computer Help Desk immediately for assistance.

First half of an elaborately written job scam sent from Gmail but impersonating a real person from UVicSecond half of an elaborately written job scam - recipients are told to apply by contacting an Mail.com email address and providing their phone number

From: CAMPUS JOBS <[redacted]@gmail.com>
Subject: Research Assistant Position

You don’t often get email from [redacted]@gmail.com. Learn why this is important.

HR Job title: Remote Research Assistant

Supervisor: Dr. [redacted]

Work Study: Applicants can be work-study or non-work-study students. Both undergraduate and graduate students are encouraged to apply. University of Victoria, Centre for Social and Sustainable Innovation is currently hiring Undergraduate or Graduate Students to fill the position of Research Assistant Position on a part time basis of $350 weekly.

Department Required Skills

– Highly motivated, with strong organizational and communication skills.
-Excellent problem-solving skills
-Team player who can work in a fast-paced environment with a multi-disciplinary team.

Preferred Years Experience, Skills, Training, Education

-Experience primarily using Windows operating systems
-Ability to adequately use Microsoft Excel.

This is a part-time position with a flexible schedule, and the successful candidate will work approximately 6-7 hours for $350  weekly. The position offers valuable research experience, and the opportunity to work with a dynamic and collaborative research team on campus.  As a Part-Time Remote Assistant Position you will play a crucial role in supporting me as I work with our partners and stakeholders to ensure that our programs and initiatives are making a real different in the lives of children around the world. Your responsibilities will include assisting with administrative tasks, organizing meetings and events, helping to manage communications and correspondence, handle mailing, making payments and purchasing Items when needed.

To proceed with the application process and other eligibility descriptions, submit your resume for review, functional phone number and year of study via this email address ([redacted]@mail.com) to receive further information on the position.

Best regards,
(he/his/him)
3800 Finnerty Road,
Victoria BC  V8P 5C2 Canada
https://www.uvic.ca/

“Staff/Student Support Program” / “University Support Program” / “Assistance Program for Employees”

This phish makes a tantalizing offer of up to $3,500 in financial assistance to tempt people to click on the link. However, the form that appears is a phishing site that first requests your username and password, and then tries to defeat MFA by telling you to be ready to confirm the login on your device.

The email is better-written than most phish, but there are still a few red flags that indicate that this offer is not genuine:

  • The email did not come from a UVic email address
  • The signature is generic and impersonal
  • The message does not mention UVic anywhere–there is only a generic reference to “the University”
  • Hovering over the link reveals that it goes to a non-UVic website

If you clicked on the link, contact the Computer Helpdesk or your department’s IT support staff immediately for assistance.

Phishing email claiming to offer up to $3500 in financial assistance to staff and students


From: [redacted]@[redacted].us
Subject: FW: University Support Program

You don’t often get email from [redacted]@[redacted].us. Learn why this is important.

In response to the economic challenges we’re all facing, I’m excited to announce the launch of a Financial Support Program designed to help both staff and students at the University.

PROGRAM DETAILS:
  • Start Date: October 8, 2024
  • Eligibility: All university staff and students
  • Financial Assistance: Up to $3,500 per eligible applicant
  • Duration: Program available through December 31, 2024

We understand how overwhelming these times can be, and we’re committed to providing support where it’s needed most.

HOW TO APPLY:
  1. Visit the Support Program [link] webpage.
  2. Follow the simple step-by-step application process.
  3. Ensure all required information is submitted.

If you think this program could benefit you, don’t hesitate to apply! We hope it brings some relief and reassurance.

Sincerely,

Employers Support Services

“Part-Time job” or “Dear user”

UNESCO job scams are making the rounds once more. Here are the signs that the job offer is not legitimate:

  • The emails did not come from UNESCO or the UN (the scammer seems to have abused compromised accounts belonging to a national government).
  • The emails tell you to contact a different address on Outlook.com. Job offers that tell you to apply by contacting an email address from a free email provider are very likely to be scams. Also, it’s suspicious that they did not provide a full name for the contact person.
  • The message contains awkward wording and poor grammar.
  • The salary is likely to be too good to be true for part-time remote work, especially if there turns out to be no interview or no knowledge/experience requirements.

We also recommend you check out our other posts on job scams for additional tips.

If you contacted the scammer, reach out to the Computer Help Desk or your department’s IT support staff immediately for assistance.

UNESCO job scam directing users to apply by contacting a suspicious Outlook.com email address.


From: [redacted]@****.gov.m*
Subject: Part-Time job

I am sharing job opportunity information to anyone who might be interested in a paid UNESCO Part-Time job with a weekly pay of $750.00. If interested, kindly contact  Sarah on her email address. ([redacted]@outlook.com) for details of employment.

N.B, this job is strictly a work from home position.

Salary Adjustment Acknowledgement

In this targeted phish, the phishers use the appeal of a salary increase to get you to open the PDF and click on the link inside it. Red flags to watch out for:

  • The email did not come from a UVic email address.
  • The greeting is impersonal.
  • There are errors in spelling, punctuation and grammar. If you are very sharp-eyed, you might also notice that lowercase a’s have been replaced with lowercase Greek letter alpha.
  • Official university emails would not use difficult-to-read light green text.

If you opened the attachment, contact the Computer Help Desk or your department’s IT support staff immediately for assistance.

Salary increase themed phish with a PDF attachment that specifically targets UVic


From: University of Victoria <*******@*******n.edu>
Subject: Salary Adjustment Acknowledgement
Attachment: [PDF icon] UVIC-protected.pdf [59 KB]

You don’t often get email from ********@*******n.edu. Learn why this is important.

Deαr Emplοyees,

I αm hαppy to let you knοw that yοur salary increase has been apprοved. We appreciate yοur hαrd wοrk and dedicαtion to The University of Victoria, and this αdjustment reflects yοur cοntributions appropriately.

Stαrting from 26 July 2024, your sαlαry will be increαsed by 16⋅82 percent.
This αdjustment αcknοwledges yοur effοrts and αligns with our cοmmitment to recοgnizing αnd rewαrding our vαluαble emplοyees.

NΟTE: Your Αccess is needed to go thrοugh the sαlαry increment letter, Initial Αccess is Salary

We lοk fοrward to yοur cοntinued successful input at The University of Victoria

Pαyrοll & Emplοyee Relαtiοns

Part-Time job.

Job scams impersonating UNESCO and other UN agencies are something we see on a regular basis. By offering a generous salary for only a few hours a week of simple remote work tasks, these unscrupulous scammers prey on students looking for extra money to cover the cost of tuition, rent and other necessities. The red flags in the email message are the usual ones:

  • The email did not come from a UNESCO or UN email address, nor did it come from a UVic sender.
  • The salary is too good to be true for part-time remote work.
  • The email contains grammatical errors and awkward wording.
  • You are told to send replies to an Outlook.com email address. If a job offer asks you to contact an address from a free email provider, there is a very high chance that the offer is a scam.
  • You are asked to reply from your personal email address. Scammers do this to shift the conversation away from UVic’s email security controls and avoid detection.

If you contacted the scammer, reach out to the Computer Help Desk or your department’s IT support person immediately for assistance. If you opened the attachment, update your computer’s antivirus and perform a full scan as a precaution.

If there is no job interview before you’re accepted into the position, or you never get to meet your supposed employer (either in person or by video call) before you start working, that is a very strong sign of a job scam. If any of the following occur, do not proceed!

  • You are told to share your UVic or other login credentials–never share those with anyone!
  • You are asked to purchase gift cards, then send photographs of them with the PIN revealed. Don’t do this even if you were given a cheque beforehand–that cheque will probably bounce and you’ll lose the money used to purchase the cards.
  • You are given a cheque to deposit in your account and told to send part of the amount to someone else. This may be a cheque overpayment scam (the cheque you received would eventually bounce, meaning the money you sent would come from your own funds), or the scammer may be trying to use you as an unwitting money mule to launder money.

A UNESCO job scam email from a non-UNESCO sender.


From: N****** <[redacted]@quadro.net>
Subject: Part-Time job.
Attachment: [Word document icon] UNESCO JOB (1).docx

You don’t often get email from [redacted]@quadro.net. Learn why this is important.


Job opportunity information to anyone who might be interested in a paid UNESCO Part-Time job with a weekly pay of $750.00. If interested, kindly contact Cargill on his email address. ([redacted]@outlook.com) with your alternate non-educational email address I.e., Gmail, yahoo, Hotmail etc.) for further details of employment.

N.B, this job is strictly a work from home position.

Yamaha Piano donation

If you get an unsolicited email that offers to give away something valuable for free and it’s not from someone you know, it’s probably too good to be true. This is very likely to be the case when someone says they are giving away a late family member’s grand piano–emails of that sort are a common scam. Some versions may even attach photos of the supposed piano, but they’re probably stock images or ripped off of somebody else’s listing. If you are told to reply from personal email or a different communication method, that is a red flag as well; scammers do this to move the conversation away from UVic email to avoid detection.

If you reply to indicate you’d like the piano, you’ll be told to contact and pay a “moving company” to ship the piano from out of town, but the moving company will turn out to be fake and you’ll never receive a piano after you’ve paid up. In general, it’s extremely risky to pay a random person or moving company for a piano (or other item of value) sight unseen; the item may not actually exist or not be what you were expecting.

Watch out for versions of the scam that impersonate real people at UVic. If the email was not sent from a UVic email address, or you’re instructed to contact an email address that is not from UVic, you can be certain the email is a scam. If in doubt, don’t reply to the email–to determine the email’s legitimacy, contact the person through another method that you know is safe (e.g.: using the contact information on their directory entry or by asking in person). Sometimes, one name will correspond to a real person at UVic but the other one will not, which is another sign of a scam.


A typical scam email offering a free piano

From: Paulina Hagerman <s*********8@gmail.com>
Subject: Yamaha baby grand 05/13/2024

Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Hello,

I’m offering my late husband’s Yamaha Piano to any music enthusiast who may appreciate it. If you or someone you know might be interested in receiving this instrument for free, please feel free to reach out to me.

Warm regards,
Paulina

A piano scam with photos attached, impersonating a real UVic employee but mentioning a person who doesn't actually work at UVic

From: [impersonated UVic employee] <[redacted]@gmail.com>
Subject: Yamaha Piano donation

Attachments: [Three thumbnail images showing a Yamaha baby grand piano from different angles]

Dear Student /Staff/Faculty,
One of our staff, Mr.Stephen Whitehead. is looking to give away his late dad’s piano to a loving new home. The Piano is a 2014 Yamaha Baby Grand size used but still new. Kindly write to him to indicate your interest on his private email( [redacted]@mail.com) to arrange an inspection and delivery with a moving company. Kindly write Mr. Stephen Whitehead via your private email for a swift response.

[impersonated UVic employee]
Assistant to the Dean
https://www.uvic.ca

University of Victoria_Update

This phish specifically targets UVic and contains many of the classic red flags:

  • The email was sent from someone outside of UVic
  • The greeting is impersonal
  • The message creates a sense of urgency and threatens you with an adverse impact
  • The message contains many grammatical errors
  • The signature is generic and doesn’t mention UVic

Hovering over the link without clicking on it (or holding down your finger on it on a mobile device) will reveal that the link goes to a page from a free online form builder. A legitimate UVic login page would not be hosted on an online form builder.

If you entered credentials on the phishing page, change your password immediately and contact the Computer Help Desk or your department’s IT support person.

Phish email specifically targeting UVic by asking you to update your account


From: [redacted]@h******.se
Subject: University of Victoria_Update

Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

Hello user,

This is the last and final notice or our administrator will disable your access to your email.

Please click here to upgrade your University Of Victoria_Update your account security by completing the required details to avoid the deactivation of your University of Victoria edu account.

A cordial greeting wu,
IT Service Desk (c)2024

Uvic Employee Salary Increase Approval 2024/25

Who wouldn’t like a salary increase, especially when the cost of living continues to be so high? But that’s precisely the feeling that phishers are trying to take advantage of when they create these kinds of phishing emails. Here are some signs that the email is not legitimate:

  • Although the message claims to be from payroll@uvic.ca, the sender information shows the email was actually sent from a non-UVic address.
  • The message greets you with your email address instead of your name.
  • The capitalization of UVic is wrong, there’s a spelling error in the sender name, and the wording of the message is awkward.
  • The email creates a sense of urgency to get you to act hastily.
  • Hovering over the link shows that it does not go to uvic.ca.

Fake salary increase email with a link to a phishing site

From: HR Deparment | uvic.ca e-Sign <yonet926@********.ne.jp>
Subject: Uvic Employee Salary Increase Approval 2024/25

This message was sent with high importance.

Hi ********@uvic.ca,

HR Department (payroll@uvic.ca) shared a new pdf file “Uvic Employee Salary Increase Approval Letter.pdf”  with you securely for your urgent attention.

VIEW DOCUMENT [phishing link]
1 item, 54.5 KB in total · Expires on 29 March, 2024

Report to uvic
© 2024

#Your Invitation to participate..

Job scammers are continuing to try to take advantage of students looking for extra cash to help pay for tuition, housing and other essentials in these times when the cost of living is so high. Below is yet another job scam that impersonates a real UVic professor.

For more information on job scams and how to spot them, see also these guides from CBC News and TD Bank.

Red flags to watch out for
  • The email came from a Gmail address. A real UVic job opportunity should be announced from a UVic email address. Ones that come from a free email provider like Gmail or Outlook are probably scams.
  • The pay is too good to be true for a part-time student job that requires no prior experience and is open to anyone.
  • The offer implies that there will be no job interview before you get assigned a work schedule. A legitimate job should give you a chance to meet the employer in person or on a video call before you accept an offer. If you are accepted without an interview, the job is very likely to be a scam.
  • The email asks you for an alternate email address and cell phone number. Scammers often do this to shift the conversation away from UVic email and evade monitoring.
  • The subject line contains punctuation errors.
Common methods that the scammers use to steal money from people who reply
  • They ask you to purchase gift cards from a local store and send photos of the cards with the PINs revealed. That gives the scammer the information needed to use the funds on the cards. The scammer either will not reimburse you at all or give you a cheque that will ultimately bounce a few days later.
  • They give you a cheque to deposit and tell you to transfer some of the funds to another person and keep the remaining funds (cheque overpayment scam). A few days later, the cheque will bounce, meaning the amount you transferred is gone from your own funds.

If you replied to the scammer, reach out to the Computer Help Desk immediately for assistance.

From: Dr. [redacted] PhD.
Subject: #Your Invitation to participate..

You don’t often get email from dg3******@gmail.com. Learn why this is important.

Hello,

If you may be interested in working as a temporary research aide collecting data remotely and earning $300 weekly, indicate interest by providing the required information below and I will send you a follow-up email detailing your work schedule.

This is an adaptable job that requires no prior experience irrespective of your major discipline.

Full Name:
Cell #:
Alternate email:

Regards,

Dr. [redacted] PhD.
Professor,
Health Information Science
HSD Building, A***
Victoria BC   Canada

Payment Confirmation

Always be wary of unexpected or unsolicited emails that contain attachments as they may contain malware. The vagueness and generic nature of this message should be a red flag and may be a ploy to get you to click on the attachment. Since the message does not address the recipient by name and provides no information about the supposed payment, it’s likely that it was a mass mailout and therefore not a legitimate invoice.

If you’re inclined to think that the attachment should be harmless because SVG is an image format, think again! SVG files can actually contain embedded scripts, meaning they can be laced with malware, which is definitely the case for this sample. If you clicked on this attachment, contact the Computer Help Desk or your department’s IT support staff immediately for assistance.

Vague email claiming to be an invoice but the SVG attachment actually contains malware

From: allen.lopez@o******.com
Subject: Payment Confirmation

Attachment: [Generic file icon] RTVBAS05GDBA09.svg (2 KB)

Payment Received, attached is your invoice.