Phishing for student info

At least four students fell victim to the latest e-mail scam sent in the guise of a message from PSU, prompting the IT Help Desk to release an e-mail alert to all students and faculty in January.

The e-mail scam, referred to as “phishing,” was an attempt by fraudsters to acquire personal information and access to private accounts by disguising themselves in e-mails and other online communications as Portland State. The e-mail looked like an official PSU correspondence, but asked for personal information that university officials say they would never ask for over e-mail.

Just how many phishing attempts are made against students and faculty at PSU is relatively unknown, according to members of the IT department. However, Jess Goodwin, systems and network analyst for Student Affairs places the average at about five to ten different scam attempts on PSU annually.

Chief of Information Security Craig Schiller said the number of students who were victims of the scam is a drop from a phishing incident last year, when, Schiller said, his department received about half a dozen reports.

“Each time we get just a handful,” he said. But even a slight drop in the number of reported hacked accounts, Schiller said, is good news.

How to avoid getting hooked

As e-mail scammers obtain increasingly sophisticated software and technology to carry out these scams, telling the difference between a fake e-mail from the school and a legitimate one may get tricky.

Goodwin said that PSU support staff would never need to ask you for your password either over the phone or within e-mail correspondence. Any password requests received that way are a clear warning sign to students that the e-mail they are looking at is most likely not legitimate.

“No one in their right mind should ever ask you by e-mail for your password or your account information or anything like that,” Goodwin said.

The IT department also cautions computer users to not follow links embedded in e-mails that direct them to other websites. Even when these links appear to lead somewhere familiar, to your PSU account login screen for example, that might not always be the case.

“URLs can be tricky things sometimes,” Goodwin said. Many phishers, in attempts to win the confidence of their victims, will create copycat websites with similar web addresses, and link to the phony sites in their e-mails.

“They can make these sites look very similar,” he added.

Goodwin advises students and faculty to open a new web browser and go directly to the website manually, rather than clicking a potentially misleading link.

Concerned users may also want to boost their anti-virus software, Goodwin said. While PSU does distribute free copies of McAfee Antivirus to students and faculty, he said the version used by the school does not contain a directory of known phishing sites–a feature that does come included in the home edition of the program. The directory feature monitors sites visited by the user, and brings up an alert when users find themselves on a site named within the list.

Students who think their account security has been compromised, or those who have concerns about phishing attempts, can visit the IT Help Desk in room 18 of the Smith Memorial Student Union basement. IT can be reached by phone at 503-725-HELP or [email protected].

Tips and tricks to avoid financial aid-related schemes

With financial aid filing season beginning, students may be vulnerable to scholarship scams, identity theft and money making schemes designed to confuse and get money from students.

Heather Mattioli, assistant director of Financial Aid, said there are a number of schemes that students may fall victim to. Students can be especially susceptible to paying for services, such as giving money to an outside company to find scholarships or help prepare their financial aid, Mattioli said. This is because the student might not know there are free services on campus to help them instead, she said.

Websites may charge money to personally review a student’s completed FAFSA form or help fill it out. Mattioli said a good rule to follow is to never spend more than the cost of a stamp to get financial aid or scholarship information.

Students can visit the Financial Aid office on campus for any help they need, she said.

Identity theft may also be an issue for students. A memo released by the U.S. Department of Education’s Office of the Inspector General details a financial aid scam that students may be particularly vulnerable to.

The memo describes a method used by scammers to illegally acquire student information and use it to apply for financial aid at community colleges. Since the tuition for community colleges is significantly lower than at larger universities, such as Portland State, the funds are often released to the assumed borrower directly. The “borrower” then pockets the cash and drops out of school.

Mattioli said to help avoid identity theft, avoid scholarship applications that ask for bank information or social security numbers.

Currently, the Financial Aid office is not aware of any specific scams on campus, but there is a section on its website where bulletins are posted to inform students if a serious scam pops up, Mattioli said.

Interim Dean of Students Michele Toppe said students have a wealth of resources on the campus, including her office, and generally they should not have to pay outside organizations for help with financial aid and scholarships.

“It takes everybody to be proactive,” Mattioli said. “So just keeping it to yourself isn’t the best thing. Even if you feel not so bright, tell somebody.”

How to avoid scams

-If you must pay money to get money, it probably isn’t legitimate.-If it sounds too good to be true, it probably is.-Be wary of requests for personal information. -If notified of a scholarship by phone, it is likely a scam.-Above all else, notify the Financial Aid office right away if you feel you have been taken advantage of.��-Information provided by Assistant Director of Financial Aid Heather Mattioli.