Many incoming first years receive scam emails from fraudulent Penn addresses

A large number of Penn students received scam emails from fraudulent Penn email addresses asking them to partake in research or job opportunities, prompting the College of Arts and Sciences to warn students.

The emails, which were primarily sent to incoming first years, appeared to come from current professors or Penn alumni. They typically contained information about paid internships or potential job and research positions, with an attached application where students were asked to submit their personal information. 

“Faculty will never ask students for their bank account information, birthdate, or for gift cards,” an email sent on May 28 to students in the College reads. 

University Chief Information Security Officer Nick Falcone said that this type of "advanced fee" scam, in which an offer of employment or other reward is used to request funds or bank account information, is attempted very frequently and often targets dozens or hundreds of email addresses at once. 

"For this most recent round of scams, all attempts by the scammers to directly contact Penn email addresses appear to have been blocked [by Penn's email filtering software]," Falcone said. "But sometimes the scams target people in ways we cannot defend against using technical means, for example by using messages to incoming students on their personal social media, email addresses, or via text messages to personal phones."

Incoming Wharton first-year Nicholas Ray Gao received an email on April 26 from who he thought was Gilbert and Shelley Harrison Professor of Health Care Management Guy David. The email, sent from a @wharton.upenn.edu address, was addressed to Gao and asked him to participate in a paid research project for $250 per week. The scammer sent a follow-up email on April 28 asking Gao to submit his current address, age, and bank name.

Gao responded to the email and agreed to participate in the research, in hopes of earning $250 each week. The remote job consisted of analyzing different prices of drugs in different convenience stores.

After completing what Gao described as “busy work,” he was sent a check for $1,000 last week and was told to virtually wire it to his bank account. Gao suspected the wiring was a scam and discontinued the research project. He was unaware of the email sent to students in the College and chose not to continue the project based on his own suspicions.

Falcone added that scammers often will impersonate a "prominent person" by using look-alike email addresses, as in Gao's case. 

"Clicking on an email address to show the full email address is one way to spot a look-alike address," Falcone said. "Even so, real email addresses can be 'spoofed' so that the 'from' address is the real email address of the person being impersonated."

Incoming College first-year Cory Shin also received a scam email from who appeared to be a Penn alumnus asking for a pet sitter. The alumnus claimed that his uncle had moved to the Philadelphia area and needed someone to watch his dogs. He offered $300 a week for six hours of pet sitting.

In Shin’s case, the email did not originate from Penn but rather from a Gmail address.  

Shin said he “didn’t think too much about it” until he later noticed through a first-year GroupMe that other students received the same email. Upon realizing that other students had received scam emails, he disregarded it.

Because incoming first years were just beginning to set up their Penn email addresses, these scam emails were some of the first emails from “Penn” email addresses that they received. 

This is not the first time that members of the Penn community have been targeted by scammers via email. 

In February 2017, a slew of Penn affiliates were targets of a phishing scam in which they were instructed to click on a series of faulty links to "update" their servers. 

A similar phishing scam occurred in October 2013, when email recipients were instructed to input their PennKey, password, date of birth, and Social Security number into what looked like a secure PennKey login screen.