Hello all,
A fraudulent email was sent to a number of faculty and staff members – almost all within a single department on-campus. What makes this message more dangerous than the typical phishing messages that are sent is that the scammers:
• Sent the email to members of that department (presumably based on the public directory listing).
• Made the name & signature of the message the actual department’s head (though the email address was not a New Paltz address).
I don’t want to specifically highlight the department who was targeted, both because this can happen to any department, and because the targeted department didn’t do anything specifically to cause themselves to be targeted. In fact – a number of their staff reported the message to me which is the right thing to do.
Even though this scam was more sophisticated than most – you can still rely on the following before clicking on an email link or opening an attachment:
• If there are links – hover over the links to see the actual destination before clicking on them.
• Even if you know the sender – are you actually expecting something from them? Does the message look like the kind of message that they would send?
• If you had clicked on the link – you would be brought to a login page. Make sure you are on the appropriate site by checking the address bar at the top before logging in.
An example of the message is below. The ‘fake’ sender has been redacted but the fake email address has been kept.
If you receive a message like this – please forward it to InformationSecurity@newpaltz.edu. Thank you to those who reported this message!
