Phishing e-mails sent to Penn State addresses

Phishing e-mails sent to Penn State addresses

University Park, Pa. -- A few new phishing e-mail scams targeting the Penn State community have come to light recently.

E-mail messages claiming to be from EDU.WEBMAIL TEAM or other addresses asking for verification of information and warning that failure to do so will deactivate the user's account are fraudulent and appear to be part of a phishing scam. These e-mail messages were not sent by the ITS Help Desk or by WebMail@psu.edu.

Security Operations & Services has been notified and they are investigating the source of the messages. Please do NOT reply to these messages as they are fake. ITS strongly recommends that the messages be deleted. Anyone who replied to any of these fraudulent messages should contact Security Operations & Services at (814) 863-9533.

Another scam has popped up on the popular message board Craig's List, and targets students looking for housing for next year. According to reports, some attractive housing listings list a Gmail address as the only contact information. When inquiring about the property, the automatic email reply will request that the interested party complete some form of credit check, including personal information or the means to access personal information. Some may have a false rental agency Web site backing up the email reply. Again, this appears to be a phishing scam, and should be avoided.

Most phishing schemes come in the form of unsolicited e-mail, with phrases like, "we need to confirm your account, please click here." However, the link leads users to a false Web site, and then prompts them to provide personal information such as their password, address, Social Security number, credit card data and more. The "phishers" then use the information to commit identity theft, a type of criminal activity that can include creating false bank accounts, maxing out credit cards and taking out loans in the victim's name.

Even if a company address may look legitimate, it's important to never send private information in response to an e-mail of this kind.