Getting fishy emails? How to protect your NKU account from fraud

Do you keep getting suspicious emails offering work-from-home positions? How about unfamiliar users looking for a personal assistant, promising big bucks upfront?

You’re not alone. NKU Outlook users could be victims of a recent “spear-phishing” campaign, a spamming strategy to dupe students into giving up money and personal info.

Here’s how you can protect yourself from phishing and annoying spam:

How can I tell spam from a legit email?

The most recent round of spam comes from Outlook addresses and advertises a part-time personal assistant position from “the Hiring Manager of ADP Payroll Solutions.” Then they ask for a phone number to contact you about the job.

Junior elementary education major Kaitlyn Long said she hasn’t received a lot of spam this year until she got four messages from the same address.

“I’ve learned from experience about what spam looks like,” Long said. “I just assume everything is too good to be true or fake.”

NKU’s IT department won’t ever ask for your account info through email, so be wary if someone claiming to be with the university asks for your username or password.

Watch out for bad spelling and grammar, and requests for phone numbers and addresses can also indicate a fishy email.

Who’s sending these emails?

It’s not clear who exactly is sending the latest round of spam, which appear to offer students “dedicated, honest” personal assistant jobs and ask for a phone number.

Associate NKU IT director Jennifer Taylor says the university email system automatically trusts nku.edu email addresses, so if one person’s account is compromised, the attack can spread “unchecked” to every user until IT corrects the problem.

“The goal is to gain the trust of the victim and entice them to reply to the email, and then to provide money for a product or service through hard-to-trace methods,” Taylor told The Northerner in an email.

What’s spear-phishing?

Spear-phishing targets specific individuals or small groups by taking student contact info from social media and other public websites, Taylor explained. After they find your information, spammers send carefully-worded emails that look real enough to bypass university filters.

“Spammers are cunning,” Taylor said. “They understand that spam filters rely on obvious key word phrases for detection, therefore they carefully exploit the fine line between spam and genuine business email by making the email content appear legitimate.”

No email account will ever be spam-free, Taylor said, so sometimes cleverly-worded junk mail makes its way to your inbox. Suspicious emails are held in quarantine, away from your inbox.

But some spammers have moved on from the suspicious link bait-and-switch.

“They forego the obvious hyperlinks to bogus websites, instead waiting for the victim to reply to the email, then they exploit the victim,” Taylor said.

Hackers of all grades use spear-phishing to steal information, even from government officials. Microsoft recently seized dozens of phony spear-phishing websites made to look like real U.S. government URLs to target politicians’ info, The New York Times reported in August..

At NKU, hackers stole over $30,000 from students in 2016 through an email check fraud scheme that also phished for victims’ bank information.

RELATED: Students fall prey to scammers, check fraud

So what should I do?

Don’t respond to the email, and don’t click links or open attachments from a user you don’t recognize.

Taylor said reporting the email as “Junk” makes it more likely for your email filter to catch it next time. If the problem continues, tell IT about it at abuse@nku.edu.

What is a quarantine ?

NKU Outlook’s quarantine scans up to 250,000 suspicious emails per day by filtering keywords and phrases spammers use to fish for your data.

Users receive an email update at the end of the day to show the emails caught by the quarantine, but you can access those anytime here. (https://inside.nku.edu/it/webmail.html.)