Scamming campaigns are not a usual sight in the inboxes of SCC email accounts. Recently, however, that changed.

On Sept. 2, an email purporting to be from Julianne Scott, an International Education department employee, was sent to students and employees by hackers. The email described a job opportunity walking dogs and offered $300 weekly.

Technology Support Services (TSS) sent an email on Sept. 4 warning the community about the phishing threat the email posed.

What Is It?

Phishing is a common tactic used by scammers to fool people into giving them personal information like credit card numbers, social security numbers and passwords by enticing them with offers that “are obviously too good to be true,” says Gavin Smith, the sole TSS app programmer.

“Sometimes phishing emails are sent from generated email accounts similar to the real address,” says TSS Director Gary Kalbfleisch. “(Scotts) email, however, seems to have been compromised.”

As soon as the email was caught several days later, Scott’s password was reset and the account was no longer compromised.

On Sept. 6, another phishing email was sent to students and employees. This time, the senders were posing as Betty Kost, a faculty member from the nursing department. Kost’s email was a computer-generated account and not her actual SCC account. 

The email offered another part-time job opportunity and promised again to pay $300 weekly.

TSS deleted this email from the inboxes of people who hadn’t yet opened it. TSS didn’t erase the email from the inboxes of users who had already opened it in case they needed to record what the hackers sent them.

Measures Taken

TSS already has security measures in place to protect SCC email accounts from receiving malicious content: antivirus and anti-phishing filters stop most incoming attacks from reaching the students and employees.

However, another phishing email was sent to students, with about 30 of them reporting to TSS that they have interacted with suspicious emails.TSS instructed those students to change their passwords on SCC’s main website.

“Unless you provided the attackers with any personal information, you shouldn’t have anything to worry about,” Smith says. “However, if any student gave them their financial information, then they should talk to their bank about it.”

Prevention

Kalbfleisch says that it’s “practically impossible” to know who was behind the attacks, as they usually come from overseas. 

“The police don’t know what to do about these things,” Kalbfleisch says. “Prosecution just isn’t going to happen.”

According to Kalbfleisch, institutions with public IP addresses like SCC face attacks on a regular basis. “Think of it like a long hallway full of doors,” he says. “Each of those doors represents an IP address. What hackers do is they run down the hall really fast, trying to find a doorknob that’s open.

“Phishing is the most effective because of the social engineering aspect of it.”

TSS recommends students to never click on links provided by suspicious emails, as well as checking the grammar and spelling on the content of the message, and especially not log in through links provided by suspicious emails. 

According to Kalbfleisch, sometimes scammers will try to get you to give up your credentials by asking you to log into, for example, the SCC website to reactivate your account.

Phishing works well because it depends purely on deception; only a bit of research is needed to make an email seem legitimate.

In the case of the SCC emails, scammers knew to target potentially strapped for cash students with very lucrative job offers that would interfere minimally with their studies.