Last week DoIT received several notifications of yet another part-time job scam arriving at email inboxes on our virtual campus.  The To: field has been removed from the example for reasons of privacy.

Over 200 members of the UMBC community received this particular message.  One of the reports also noted that a similar scam naming Corestaff Services appeared in 2018 in accounts at Brown University.  Brown posted a very detailed analysis of the message at: https://it.brown.edu/alerts/read/corestaff-phishing-email-anatomy-scam.

While this message doesn’t share all the issues of the one that went to Brown, it does raise some questions.

• Why would the message come from a gmail account rather than a corporate domain like corestaff.com?

• What kind of professional HR Manager uses an account called ‘blueeyedwelch’?

• Why do they want your alternate email address before they tell you anything else about the job?  They obviously have your UMBC address already.

• Why is there no web link or phone number for Corestaff Services anywhere in the message?

• “PART-TIME” and “PART TIME” will not set off your spell-checker.  “PARTTIME” is not a word.

When you get a message you were not expecting that asks you to provide information, please remember that all information has value. Even the simple fact that you are reading the email sent to your UMBC address has value.  If you send a response, even an angry or insulting one, you are giving the sender something of value.

Read once, think twice.  If you are unsure, please forward the message to security@umbc.edu.  It always helps if you include the headers, too. 

How do I forward full email headers?

(https://wiki.umbc.edu/pages/viewpage.action?pageId=1867970)