The perpetrator sends a brief, targeted and urgent email to an individual(s) within the organization.
The perpetrator impersonates the victim’s supervisor or another well know executive in the organization by changing the Display Name of the email account. The scammers can reuse this email address many times over by changing the display name to be relevant for their next campaign.
The perpetrator sends an email requesting the victim go buy a bunch of gift cards. There can be various reasons why the gift cards are needed. The request will be urgent, often pleading that the individual purchase gift cards in the next hour and the request will usually involve the purchase of 10 or 20 cards of reasonable denomination.
If the victim continues and purchases the gift cards, the perpetrator will then state that they cannot meet to retrieve the cards in sufficient time. Instead, the victim is asked to send the gift card authorization codes.
Once the codes are sent, it is game over. The victim has been scammed for the amount spent on the gift cards and the perpetrator is gone.
This method is most effective on phones and small form factor devices where the entire email address is not displayed. The same methods can be used over text messages, too.
Report any suspicious emails to abuse@wm.edu. And, never buy gift cards for anyone at William & Mary!
Collapsible table
Here's a real world example of the gift card scam. (Click to view)
From: John ------- <officeexec.mails@inbox.lv> Sent: Thursday, September 6, 201911:20 AM To: Emily ------- <e------@--------.---> Subject: Respond
Let me know when you are available. There is something I need you to do. I am going into a meeting now with limited phone calls, so just reply my email.
John -------
Sent from my iPad
-----------------------------
Subject: RE: Respond Date: 6 September 2019at 21:24:35 From: Emily ------- <e------@--------.---> To: John ------- <officeexec.mails@inbox.lv>
Did you intend to send this to me?
Emily ------- Project Manager
Sent from my iPhone
-----------------------------
From: John ------- <officeexec.mails@inbox.lv> Sent: Thursday, September 6, 201911:28 AM To: Emily ------- <e------@--------.---> Subject: RE: Respond
Yes Emily, can you get this done ASAP? I need some couple of gift cards. There are some listed clients we are presenting the gift cards. How quickly can you arrange these gift cards because i need to send them out in less than an hour. I would provide you with the type of gift cards and amount of each.
Sent from my iPad ---------------------
Subject: RE: Respond Date: 6 September 2019at 21:48:03 From: Emily ------- <e------@--------.---> To: John ------- <officeexec.mails@inbox.lv>
Can do now. I’ll put on my credit card. Send me the following:
Type Number Amount
Emily ------- Project Manager
Sent from my iPhone -------------
From: John ------- <officeexec.mails@inbox.lv> Sent: Thursday, September 6, 201911:52 AM To: Emily ------- <e------@--------.---> Subject: RE: Respond
The type of card I need is Apple iTunes gift cards. $100 denomination, I need $100 X 20 cards. You might not be able to get all in one store, you can get them from different stores. When you get the cards, Scratch out the back to reveal the card codes, and email me the codes. How soon can you get that done? Its Urgent.
Sent from my iPad
--------------------------
Subject: RE: Respond Date: 6 September 2019at 21:55:17 From: Emily @ ------- <e------- distracted.com> To: John ------- <officeexec.mails@inbox.lv>
I can do now. Do you want me to do online instead?
Emily ------- Project Manager
Sent from my iPhone -------------------------
On Sep 6, 2019, at 11:57 AM, John ------- <officeexec.mails@inbox.lv> wrote:
I need you get physical card from the store
Sent from my iPad
---------------------------
Subject: Re: Respond Date: 6 September 2019at 22:01:32 From: Emily ------- <e------@--------.---> To: John ------- <officeexec.mails@inbox.lv> On my way to store now. What time need by?
Sent from my iPhone
---------------------
On Sep 6, 2019, at 12:05 PM, John ------- <officeexec.mails@inbox.lv> wrote:
As soon as you can. I will await codes
Sent from my iPad
--------------------------
Subject: Re: Respond Date: 6 September 2019at 22:13:37 From: Emily ------- <e------@--------.---> To: John ------- <officeexec.mails@inbox.lv> If choice between the two do you want $15 or $25?
Sent from my iPhone
---------------------
On Sep 6, 2019, at 12:16 PM, John ------- <officeexec.mails@inbox.lv> wrote:
$100
Sent from my iPad
----------------
Subject: Re: Respond Date: 6 September 2019at 22:51:58 From: Emily ------- <e------@--------.---> To: John ------- <officeexec.mails@inbox.lv>
Just texted you the first 11 codes. Heading to another store now. 5 and 6 limit per store.
Sent from my iPhone
------------------------
On Sep 6, 2019, at 12:54 PM, John ------- <officeexec.mails@inbox.lv> wrote:
Email the codes to me
Sent from my iPad
---------- End of email thread.
Conclusion: One hour and twenty five minutes later, the bad guys had 2 thousand dollars in iTunes gift cards in their hands and Emily had charged all of them on her personal credit card. OUCH!
Perpetrators thrive on uncertainty. They are skilled social engineers that know how to play on an individuals’ stress and confusion during unusual circumstances. Please be vigilant!
Questions? Contact the Technology Support Center (TSC) 757-221-4357 (HELP) | [[support]] | Jones 201, Monday - Friday, 8:00 am - 5:00 pm
