Beware of Business Email Compromise Attacks and Friday Phishing

Please be on the lookout for ‘Business Email Compromise’ phishing scams. This tactic is not new but has recently grown in popularity. It’s important to note that these attempts are often launched on Fridays, especially before long weekends. Hackers create a free and external email account that loosely correlates to an employee’s name you are familiar. They will then send out a very short and vague message. See the below example:

From: Justin Hickey <jhick7323@aol.com>
Date: Friday, May 17, 2019 at 12:22 PM
To: "Doe, Jane G." <jdoe@fairfield.edu>
Subject: [External] Urgent Request

 Hey, are you in today ? Need a favor:

 Justin Hickey

 Sent from my Galaxy

Important tip-offs of a scam include the [External] tag , the overall urgency of the request, and the non-fairfield.edu email address.

This is an effective technique because the hacker can quickly identify a pool of people who accept this request as legitimate. If you were to reply with, “Yep. What’s Up?” they would respond with an urgent situation in which they need you to purchase gift cards, wire them money, or provide them your id and password. The situations can often be compelling and we all want to help a colleague if we can. 

 Here are a few recommendations on how to respond:

1. Ignore it. Chances are it’s a scam.
2. Insist on a more secure communication method, “Please contact me only with your Fairfield.edu email address”.
3. Respond with “How can I call you? I’d rather not discuss this over email.”

Please continue to forward any and all suspected scam messages to phishing@fairfield.edu .

If you have any further questions, please visit  http://phishing.fairfield.edu or contact the Help-Desk. 

Many Thanks,

Justin Hickey
Chief Information Security Officer
Fairfield University
jhickey@fairfield.edu
203-254-4058