There is an ongoing phishing campaign targeting students at York University as well as other Canadian universities with a fake research job promising good money for very little effort. These phishing emails use a technique called “spoofing” to appear as though emails were sent by a York University professor- even though they were NOT- in an attempt to appear credible.

A sample of this type of phishing email is shown below:

 

The aim of this phishing campaign is to recruit “money mules” who will launder money on behalf of the scammers. Scammers who have compromised other victims’ bank accounts will send payments to a money mule’s personal bank account and request that the money mule use those funds to purchase gift cards or cryptocurrency for the scammers; mediums of payment that are difficult to trace.

 

The scam proceeds as follows:

 

1. Recipients deceived by the phishing email reply to the scammers with their contact information.
2. Scammers reply back, asking for additional personal information as part of the non-existent application process.
3. After recipients provide the requested information, the scammers claim that the recipient has been selected for the paid position.
4. Scammers provide money mules with a basic data entry task which is easily completed.
5. Scammers then ask money mules to deposit a cheque into their personal bank accounts, keep a portion of the funds, and purchase gift cards with the rest
6. If money mules follow through and provide the scammers with the gift card codes, the scammers have successfully laundered their stolen money. Scammers may continue sending cheques to the money mules to purchase more gift cards (variations of this scheme may also ask for cryptocurrency).
7. The money mule’s bank eventually flags the fraudulent transaction(s) and freezes the money mule’s bank account. The money mule may be held financially responsible for the fraudulent transaction(s) committed through their bank account.

 

Please exercise extreme caution when receiving emails that claim to be from a well-known or reputable person which offer well-paid, low-effort positions; this is “too good to be true”. Additional red flags include:

• Requests to switch correspondence to a different email address or application (Discord, WhatsApp, Signal)
• Requirements to use one’s personal bank account to complete tasks
• Requests to purchase gift cards or cryptocurrency as part of one’s work

The Canadian Anti-Fraud Centre has documented this type of scam: Money mule awareness (antifraudcentre-centreantifraude.ca)

If you have received such an email, please do not reply to it or any email addresses it lists. If you suspect that you may have fallen for this phishing scam and either provided sensitive information to or performed actions for the scammers, please reach out to the Information Security team via infosec@yorku.ca.