Rachel E. Brenner was in her apartment one Thursday morning when she got the urgent email. Jason E. Lane, her interim dean, needed help on “something very important right away.”
Brenner, an assistant professor of counseling psychology at the University at Albany’s School of Education, hurried out the door and drove to campus, her mind abuzz. Maybe it was about her research, which they’d discussed the day before. As soon as she walked into her office, she wrote back: “I’m free!”
It was then that she got the dispiriting reply. He wanted Brenner to buy iTunes gift cards for his cousin’s birthday. What an abuse of power directed at a young female professor, she thought, and so out of character for Lane, whom she knew to be a good guy.
That’s because it wasn’t Lane. Brenner quickly realized she was the target of a phishing scam — one that has targeted faculty members at more than a dozen universities and perhaps unknowingly exploits academe’s power dynamics for some quick cash.
Phishers have posed as deans and department chairs, asking professors to purchase and send photos of gift cards for iTunes or Amazon. The scam has been employed nearly identically at departments from Harvard University to Appalachian State University, from the University of Houston to the University of Iowa.
Early in the exchange, the scammers often say they are “in a meeting"— what dean or department chair doesn’t have long meetings? — but promise to reimburse the professor soon. The sender’s email address doesn’t raise red flags because, in many cases, the scammers have created a fake email account that includes the name of the person they impersonate.
Laugh it off as an attempt to make a quick buck off university employees, but the scam hits many faculty members in an especially vulnerable spot: their desire to please their bosses.
Brenner now feels she can laugh at herself, but she realizes that the structure of academe meant she was motivated to respond to even unusual requests.
“The words ‘power differential,’” she said, “keep coming to mind.”
Lane — the real Lane — said he found the scam to be creepy and a bit scary. His immediate concern, he said, was worrying that his faculty or staff would be hoodwinked as the scammer used his name, down to the middle initial, to create a Gmail address. He had started as interim dean just that semester and noted that faculty members may not be familiar with how he writes.
Public Listings, Public Vulnerability
Joel W. McGlothlin was catching up on email after holiday travel when he saw a note flash across his phone screen. “Hello. Are you available right now?”
It appeared to be from Robert Cohen, his new department head in biological sciences at Virginia Tech. McGlothlin, who responded to the email because he wasn’t yet familiar with Cohen’s communication style, said he soon realized it was a scam and ultimately doubted other professors would fall for the scheme.
Still, he’s spun out possible scenarios. Maybe the scammers were targeting departments with new leadership. Maybe they were testing which email addresses were active. “Maybe I’m giving them too much credit,” he said.
The real Cohen told The Chronicle in an email that it was lucky no one was fooled or harmed. University staff members alerted other professors about the attempt.
Public listings of department faculty and contact information, though common at many colleges, can be a security vulnerability, said Jason Davis, director of information-technology systems and services at the University of Minnesota at Duluth. Davis said his office has warned professors of these attacks through newsletters and in department meetings.
All the scammers need is to catch a small percentage of targets on an off day because they reach out to so many people, Davis said.
Davis said the scammers have assumed the identity of one particular staff member at Duluth about 15 times.
When Joshua S. Goodman, a pre-tenure associate professor of public policy at Harvard University’s Kennedy School, saw the email at an academic conference a few months ago, he wanted to be helpful to Bridget Terry Long, the dean of Harvard’s Graduate School of Education, whom he thought was contacting him.
It felt like an honor to get a note from Long, a scholar he has long admired. He was about to respond before he realized the email wasn’t from her official university address.
“Junior faculty members are constantly thinking, What can I do to make my employer love me and make them keep me for the rest of my life?” he told The Chronicle. “If it’s buying Amazon gift cards, that’s much easier than the tasks I should be doing ... I’d take that deal in an instant.”
Scamming the Scammers
He was at home one Saturday morning in January when he got another email from a fake “Long.” And he wanted to have some fun. (He later posted about the exchange on Twitter.)
“Are you available right now??” the account wrote.
“Yes, what’s up?” he responded.
As usual, the fake dean said she was in a meeting where phones couldn’t be used and needed help right away. He said he was happy to help, and she asked for $500 in Amazon gift cards.
“Can’t your administrative assistant help with that?” he wrote.
The impostor pressed on, peppering Goodman with messages. “I will reimburse you back when I get to the office,” read one note. Another: “When you get them, just scratch it and take a picture of them and attach it to the email then send it to me here.”
He expressed concern that she appeared to be in a five-hour-long Saturday meeting. And he wondered how he could be sure it was really her.
“One option,” he wrote, “is you could tell me what you consider to be the single most important finding is in your QJE article on the FAFSA as a barrier to college attendance. I love that paper and feature it prominently on my syllabus.” (The scammer did not venture a guess.)
Long later wrote on Twitter that the scammer “most certainly was not me.” But she shared there that the scammers got something right about posing as a dean.
During that Saturday exchange between the scammer and Goodman, the real Long was in fact in a meeting — with other deans, to boot.
Lindsay Ellis is a staff reporter. Follow her on Twitter @lindsayaellis, or email her at lindsay.ellis@chronicle.com.
