This phishing message not only is a great example of the phishing threats people have been receiving lately, but also has important lesson we’ll talk about at the end (spoiler: if this phishing message looks familiar, you’ve got a good sense of where we’re going!)
1. Imitation of Vassar community member – This phishing message was made to look like it was sent from someone within the Vassar community. This is a common phishing strategy, especially those sent to email accounts associated with schools and companies. This is a way that these emails try to establish reliability, but you should always question if it is reasonable for the supposed to sender to be contacting you, and if it matches with the signature and email.
2. Suspicious email address – For example, you could check the person who supposedly sent the email against the actual email address. This particular address not only didn’t match this information, but was a string of random letters and numbers. This should immediately be a red flag; no one legitimate would ever send an email that is unidentifiable like that. You can also see that the address is from an @gmail.com domain, while Vassar emails typically from from an @vassar.edu domain. The combination of these two pieces of information suggest this is a burner account, meaning an email account made to send out these emails and then be discarded. Gmail accounts are very easy to make but need to be unique, hence the random string of characters.
3. Vague subject – The subject “Vassar College” is incredibly vague, and is trying to make the email seem applicable to a large number of people. Any vague subject line (or greeting) could be a sign that this is a mass sent email from outside the community.
4. Strange grammar – The phrase “used like new” is a very confusing way to describe the condition of the piano – is it used, or like new? This may seem nitpicky, but these sorts of slips can reveal that an email is not legit when other parts may seem more real. It’s possible this is phrased this way to try to attract more people, like the vague subject line, or it could be a slip of grammar, but either way, it’s a sign of phishing.
5. Call to action – This line is where you can see what this phishing email is trying to get you to do. They want you to contact another burner email account (this address was different than the sending one, but also a string of random characters) to continue to phishing scheme. While there is not the typical attempt for urgency that other phishing emails use, this email instead is trying to spread its reach by encouraging others to share it. While it may not get the people it’s been sent to, the people sending it are hoping it will spread beyond their original reach to get someone who will respond.
6. We’ve seen this one before! – Now for the extra lesson from this message: This isn’t the first time we’ve seen this specific attempt at phishing at Vassar. While not necessarily from the same person, this phishing attempt from almost a year ago has a near identical setup as this message, even down to the phrasing. This is one of the reasons it’s so important to report phishing messages, be aware of when you receive one, and even check this website (not to self promo too much!). Phishing messages often work in cycles, showing up over and over in different forms. This also means when you receive a phishing message, you can often Google it to see if anyone else has every received it. This can save a lot of stress, help you get familiar with what phishing messages look like, and get better at recognizing them!
