BGSU :: Offices :: ITS Fraud Notice

ITS Fraud Notice

ITS Fraud Notification and e-mail messages

This ITS Fraud Notice web page and the associated ITS Fraud Notice e-mail messages have been established as a means for BGSU account holders to receive information regarding items they may have seen that has been determined to be fraudulent in nature.

As suspected information is reported, reviewed, and determined to be fraudulent, messages will be sent from the ITS Fraud Notice e-mail address to BGSU account holders and listed on the ITS Fraud Notice Message Sent web page.

All messages sent from the ITS Fraud Notice e-mail account will be digitally signed with a PGP signature. A PGP signed message will state at the beginning that it is a PGP signed message and will contain an PGP signature line at the end. A public key is available to check the message. Any message received from the ITS Fraud Notice that does not contain a PGP signature should be considered fraudulent.

This web page and e-mail alert system will provide further reference points that BGSU account holders can use in determining if information received is legitimate.

In addition to the specific information outlined in the links below, please be aware of the fraud methods outlined on the ITS Security web pages at www.bgsu.edu/infosec.

A Sampling of Fraud Types

Phishing

"Phishing" (pronounced fishing) is a technique using e-mail or similar means to deceive you into providing account numbers, passwords, credit card numbers, or similar information that could be used to perpetrate fraud.

Often the e-mail will use actual logos, privacy statements, contact information, or other visual cues from a trusted company such as a bank to make it look authentic. The goal is to entice you to click on a link in the e-mail without thinking, which will take you to an authentic-looking but hostile web site to harvest your personal information.

See the ITS Security Phishing web page for details on the following:

* Recognizing a phishing scheme

* Examples

* Protecting yourself

* What to do if you responded to a phishing scheme

* More information

Advance Fee Fraud

Advance fee fraud is a trick in which the victim is persuaded to advance sums of money in the hope of realizing a larger gain. The most visible and common is the Nigerian Scam or 4-1-9 fraud named after the section of the Nigerian criminal code that it violates. This scam has been around for years and it continues to draw in victims.

An advance fee fraud will appear as an e-mail letter claiming to come from a person needing to transfer large sums of money out of the country. Variations of the letter have been known to allege unclaimed winnings in foreign lotteries or an inheritance. In a more recent variation of the scheme, victims receive a counterfeit cashier's check to purchase an expensive item such as a car or boat from an online classified ad. The counterfeit cashier's check is for an amount greater than the value of the item and the victim is asked to return the difference.

An FTC Consumer Alert has been issued for this type of scam and a web site displaying variations of this type of message are available for your reference.

"Vishing"

Vishing (voice phishing) uses Voice over Internet Protocol (VoIP) phones instead of a misdirected Web link to steal user information. VoIP technology enables inexpensive and anonymous Internet calling and also provides the ability to easily trick the ID display into showing inaccurate information. Phishing works by sending an e-mail to people pretending to be a legitimate business and asking the recipient to click on a link to verify their account information. In a vishing message, the recipient is directed to place a phone call to verify account information. When the victim places the phone call, they are connected to a VoIP phone with a message directing the victim to enter their account number and other relevant information.

Not all vishing attacks begin with an e-mail however. In some cases, the victim receives a call in which the caller already knows the recipient's credit card number and asks for the valuable three-digit security code on the back of the card. Vishing is particularly deceiving because it employs methods legitimately used when interacting with financial institutions. Any suspicious calls or e-mail messages received may be handled by the account holder initiating contact with the company using the information available on a bank statement or on the back of a credit card.

Previously Released Alerts

Fraudulent Chase Account Verification Phishing Scheme

Phishing scams called "Vishing" that use telephones to gather information

Fake "Verified by Visa" Scam

Fraudulent Pay Pal Account Verification

Phishing attacks: fake Yahoo! Photos Sign In page

Fraudulent Sky Bank email targeting BGSU (updated from 8/30/2005)

Hurricane Katrina malware and donation scams

Sky Bank phishing scheme

Infections, viruses and key-loggers via blogs

BGSU Police issued e-mail bank fraud alert - Police Advisory, Sample #1, Sample #2, Sample #3, Sample #4, Sample #5

Identity Theft Through PayPal and Bank Scams