PHISHING EXAMPLE: WORK AFTER CLASSES OFFER ($500 WEEKLY SALARY)

September 10, 2021

What makes this a phishing message?

This very simple, but effective, targeted phishing scam used a fake job offer to establish rapport with recipients and collect personal information. 

There are a few clues that the message is a forgery:

  • The criminal is sending from a gmail.com account instead of an @berkeley.edu address
  • The criminal never mentions the name of the company she is offering the recipient employment in

Tips if Something Seems Off:

Double-check the email address before responding

Look to make sure the email address is correct. In Gmail hover your mouse over the sender name for the email to display. On a mobile phone or a touchscreen, press and hold the link (don't tap!) to reveal the actual URL. (Look in the bottom left corner of the browser window.) Don't click on a link unless it goes to a URL you trust.

Follow up with the sender separately

If you didn’t expect it, reject it. Or follow-up with the individual directly in a separate email or call/text to confirm.

Report and/or flag it

  • Open the message

  • To the right of 'Reply' arrow

  • Select 'More' (typically denoted with three vertical dots)

  • Then 'Report phishing'

If you are unable to log into bMail, forward the message to phishing@berkeley.edu For more information visit https://security.berkeley.edu/resources/phishing

Original Message:

From: Linda MOORE <linda.incorporation@gmail.com>
Date: Thu, 2 Sep 2021 20:34:53 +0100
Subject: WORK AFTER CLASSES OFFER ($500 WEEKLY SALARY)
To: undisclosed-recipients:;

Hello,

Are you currently in the US? Here is an opportunity for you to work part
time after classes and earn $500 weekly.

The job is completely done online and can be completed anytime in the
evening/night at home and won't take much of your time daily, you don't
have to be online all day and don't need any professional skill to do
the job, all you need is just come online before going to bed to forward
all order of the day made by agents to the supplier and you are done for
the day.

We have 12 Agents in the United States that are working for the company,
they need materials like labels, staplers, envelopes, files and stamps
to do their daily job. they will email you whenever they need materials
and also state the type of materials they need and the quantity, it is
now your duty to contact the supplier through email to place orders for
the materials and also state the quantity that should be mailed to the
agent address through the post, the supplier will then visit the post to
mail the materials to the agent.

We are a New Zealand based company that offers company registration
services to clients all over the globe.

Each agent will only order for materials once in a week, we are
employing you just to reduce the workload for us, our supplier and for
the agents.

If you still care to proceed with the job, get back to us with the
information listed below then we can proceed from there.

1, NAME:
2, ADDRESS, STREET NAME AND HOUSE NUMBER, NOT P.O BOX:
3, CITY:
4, STATE:
5, ZIP CODE:
6, MOBILE:

You currently have to be in the United States and the address you will
provide to start the job, the address we request for is for your weekly
$500 check to be mailed to.

You can try the job a week and see if it is what you can continue with
or not, you can also quit the job anytime after a week but you need to
notify us a day before.

I await to hear from you ASAP if you want to proceed with the job.

Best regards,

Linda Moore

Warning:  The links and email addresses included in these messages are from real-life examples, do not attempt to explore them.

The most dangerous links have been removed - you can hover your cursor over these links to see the original address in a pop-up techtip (instead of in the corner of the browser window).

How to report phishing:

  • Open the message

  • To the right of 'Reply' arrow

  • Select 'More' (typically denoted with three vertical dots)

  • Then 'Report phishing'

If you are unable to log into bMail, forward the message to phishing@berkeley.edu