Recently, several phishing emails have been reported involving fake job offers, performance evaluations, and financial assistance programs. These messages are designed to look as if they come from a university member, an employer, or another trusted organization and include links to external forms, websites, and contacts. The goal of the message is to trick you into thinking they are offering a legitimate opportunity for money or employment. Unfortunately, a lot of the time, the trick works.
How to Outsmart the Scammers
Want to help protect yourself from falling prey to these phishing emails? It only takes two steps. When you get an offer that seems almost too good to be true:
- Pause before you click. Beware of opportunities that offer flexible hours, remote work, good pay, grants, or financial support. Appealing opportunities can make your brain want to act fast. Take a beat before you share personal information, send money, or purchase items. Be cautious of unexpected offers, even when they appear to come from a familiar department or organization. See “Identifying Fraudulent Emails” below for more tips.
- Verify that the opportunity is legitimate. Look for the position or financial assistance program through an official university or employer website. Contact the department or organization directly using contact information you find independently. Never trust contact information or links that are provided in the email before verifying their legitimacy.
Identifying Fraudulent Emails
Knowing what types of emails are suspicious is your first line of defense. The “red flags” below can help you identify them:
- Unexpected job offers promising high pay, flexible hours, or remote work with little experience required.
- Offers of employment without a formal interview or legitimate hiring process.
- Financial assistance programs that look similar to a legitimate university program but cannot be confirmed on the university or organization’s official website.
- Senders claiming to represent a university or employer by someone who sends the email from a personal email address.
- Requests to continue the conversation using a different email address, phone number, or messaging app.
- Promises to reimburse you for purchasing gift cards, electronics, or other items.
- Requests for personal information, such as your address, Social Security number, or banking information, before you have verified the employer and the position.
- Performance evaluation notifications sent from a personal email account.
- Being pressured to respond quickly or accept a time-sensitive offer.
- Shortened URLs that direct to webpages that look like an official university or organization’s page and ask you to sign in.
Be cautious of any emails, texts, or links that prompt you to provide your login information and Multi-Factor Authentication (MFA), as this can lead to unauthorized access to your account. If you receive any unauthorized MFA prompt, immediately deny the request, change your password, and contact the Network Support Center.
Reporting and Responding to Phishing Attempts
If you suspect you’ve received a phishing email, please report it to the Information Security Office by forwarding the email to support@sfbrn.calstate.edu or submitting a Security Reporting ticket. We can help determine whether the message is legitimate or not and take appropriate steps to protect other members of the campus community.
If you think you may have already disclosed your personal information through a phishing attempt, contact the Information Security Office immediately for guidance.
Sincerely,
Thomas Dixon
Chief Information Security Director and Data Privacy Officer
Information Technology Services
San Francisco Bay Region Network