Phishing Alert - 8/28/2019
by Anonymous in phishing scams, security
Dear Campus Community:
We have seen recent activity targeting students’ financial aid refunds through phishing emails. We have provided an example of a financial aid phishing attempt below. The email attempts to lure students into logging into a fake University web portal, similar to myCI, for the purpose of accessing financial aid information. The attackers are able to use student login information provided through this web portal to access the student’s account and change the student’s direct deposit information. As a result, financial aid funds can be rerouted to a bank account controlled by the attacker. Therefore, the University has temporarily disabled all direct deposit bank information from student accounts. Students who anticipate receiving a refund will be mailed a check to the mailing address on file.
If you have clicked or responded to a phishing attempt, we recommend that you contact your financial institution about any possible fraudulent activity on your accounts and contact the Solution Center at solutioncenter@csuci.edu or 805-437-8552 to assist you with initiating a virus/malware scan.
CSUCI data has not been breached; this was a phishing campaign targeting student financial aid. Any information about financial aid and student refunds will come from an official University email account (sbs@csuci.edu / financial.aid@csuci.edu / financial.aid-global@csuci.edu) and no other email address.
As a precaution, Information Technology Services (ITS) has deleted the phishing email from all student inboxes and reset the passwords of all students who received this phishing email to ensure no malicious activity is actively in progress. If you need to reset your password, you can reset it using the Forgot Password service.
If you have any questions regarding this issue, please contact the ITS Solution Center at solutioncenter@csuci.edu or 805-437-8552, or Information Security staff at infosec@csuci.edu.
Please note, no member of ITS or of CSUCI will ever initiate contact with you for your ID, password or any other personal information either in an email, over the phone, and especially in an anonymous form. Only with your continued awareness and ongoing vigilance will we be able to keep your CSUCI data properly secured. If you receive an email which you suspect may be an attempt to phish for your personal or financial information, please contact Information Security at infosec@csuci.edu.
For more information on phishing, please visit the ITS Security website.
