Spear phishing targeting Accounting/HR
This spear phishing scam impersonates a finance manager at a consulting firm to create a realistic narrative of an overdue business invoice. It establishes legitimacy by including a fake email thread that references a specific University leader, making it appear as though the request has already been vetted and approved internally. By framing the payment as "long overdue" and providing a specific bill number, the scam leverages professional accountability to pressure the accounting department into making a quick payment without further verification.
DO NOT engage in email exchanges, give money or accept their checks, give passwords, gift cards, or any personal information. Report these emails as phishing in your email account. If you have given them money or banking information, contact your bank ASAP. Questions? Contact UIndyIT at [email protected].
How to identify scam
Here are some specific red flags to recognize in this phishing email:
- Mismatched email addresses - The sender has two different email addresses listed.
- Faked and easily forged conversation with UIndy Leadership.
- Company name - This is a vendor we've never done business with.
- Requesting payment.
What to do if you suspect a scam or have been scammed
- Check with the business owner, in this case, check with Dr. Tanuja Singh or her Administrative Assistant.
- Report the message as phishing in Gmail to help protect others who may have received a similar phishing email.
- If you are unsure or believe something is fraudulent, forward the email to IT Help Desk ([email protected]).