> Skip to content
FEATURED:
  • The Evolution of Race in Admissions
Sign In
  • News
  • Advice
  • The Review
  • Data
  • Current Issue
  • Virtual Events
  • Store
    • Featured Products
    • Reports
    • Data
    • Collections
    • Back Issues
    • Featured Products
    • Reports
    • Data
    • Collections
    • Back Issues
  • Jobs
    • Find a Job
    • Post a Job
    • Career Resources
    • Find a Job
    • Post a Job
    • Career Resources
Sign In
  • News
  • Advice
  • The Review
  • Data
  • Current Issue
  • Virtual Events
  • Store
    • Featured Products
    • Reports
    • Data
    • Collections
    • Back Issues
    • Featured Products
    • Reports
    • Data
    • Collections
    • Back Issues
  • Jobs
    • Find a Job
    • Post a Job
    • Career Resources
    • Find a Job
    • Post a Job
    • Career Resources
  • News
  • Advice
  • The Review
  • Data
  • Current Issue
  • Virtual Events
  • Store
    • Featured Products
    • Reports
    • Data
    • Collections
    • Back Issues
    • Featured Products
    • Reports
    • Data
    • Collections
    • Back Issues
  • Jobs
    • Find a Job
    • Post a Job
    • Career Resources
    • Find a Job
    • Post a Job
    • Career Resources
Sign In
ADVERTISEMENT
News
  • Twitter
  • LinkedIn
  • Show more sharing options
Share
  • Twitter
  • LinkedIn
  • Facebook
  • Email
  • Copy Link URLCopied!
  • Print

Phishing Scheme Targets Professors’ Desire to Please Their Deans — All for $500 in Gift Cards

By  Lindsay Ellis
January 23, 2019
phishing0123

Rachel E. Brenner was in her apartment one Thursday morning when she got the urgent email. Jason E. Lane, her interim dean, needed help on “something very important right away.”

Brenner, an assistant professor of counseling psychology at the University at Albany’s School of Education, hurried out the door and drove to campus, her mind abuzz. Maybe it was about her research, which they’d discussed the day before. As soon as she walked into her office, she wrote back: “I’m free!”

It was then that she got the dispiriting reply. He wanted Brenner to buy iTunes gift cards for his cousin’s birthday. What an abuse of power directed at a young female professor, she thought, and so out of character for Lane, whom she knew to be a good guy.

We’re sorry. Something went wrong.

We are unable to fully display the content of this page.

The most likely cause of this is a content blocker on your computer or network. Please make sure your computer, VPN, or network allows javascript and allows content to be delivered from c950.chronicle.com and chronicle.blueconic.net.

Once javascript and access to those URLs are allowed, please refresh this page. You may then be asked to log in, create an account if you don't already have one, or subscribe.

If you continue to experience issues, contact us at 202-466-1032 or help@chronicle.com

phishing0123

Rachel E. Brenner was in her apartment one Thursday morning when she got the urgent email. Jason E. Lane, her interim dean, needed help on “something very important right away.”

Brenner, an assistant professor of counseling psychology at the University at Albany’s School of Education, hurried out the door and drove to campus, her mind abuzz. Maybe it was about her research, which they’d discussed the day before. As soon as she walked into her office, she wrote back: “I’m free!”

It was then that she got the dispiriting reply. He wanted Brenner to buy iTunes gift cards for his cousin’s birthday. What an abuse of power directed at a young female professor, she thought, and so out of character for Lane, whom she knew to be a good guy.

That’s because it wasn’t Lane. Brenner quickly realized she was the target of a phishing scam — one that has targeted faculty members at more than a dozen universities and perhaps unknowingly exploits academe’s power dynamics for some quick cash.

ADVERTISEMENT

Phishers have posed as deans and department chairs, asking professors to purchase and send photos of gift cards for iTunes or Amazon. The scam has been employed nearly identically at departments from Harvard University to Appalachian State University, from the University of Houston to the University of Iowa.

Early in the exchange, the scammers often say they are “in a meeting"— what dean or department chair doesn’t have long meetings? — but promise to reimburse the professor soon. The sender’s email address doesn’t raise red flags because, in many cases, the scammers have created a fake email account that includes the name of the person they impersonate.

Laugh it off as an attempt to make a quick buck off university employees, but the scam hits many faculty members in an especially vulnerable spot: their desire to please their bosses.

Brenner now feels she can laugh at herself, but she realizes that the structure of academe meant she was motivated to respond to even unusual requests.

“The words ‘power differential,’” she said, “keep coming to mind.”

ADVERTISEMENT

Lane — the real Lane — said he found the scam to be creepy and a bit scary. His immediate concern, he said, was worrying that his faculty or staff would be hoodwinked as the scammer used his name, down to the middle initial, to create a Gmail address. He had started as interim dean just that semester and noted that faculty members may not be familiar with how he writes.

Public Listings, Public Vulnerability

Joel W. McGlothlin was catching up on email after holiday travel when he saw a note flash across his phone screen. “Hello. Are you available right now?”

It appeared to be from Robert Cohen, his new department head in biological sciences at Virginia Tech. McGlothlin, who responded to the email because he wasn’t yet familiar with Cohen’s communication style, said he soon realized it was a scam and ultimately doubted other professors would fall for the scheme.

Still, he’s spun out possible scenarios. Maybe the scammers were targeting departments with new leadership. Maybe they were testing which email addresses were active. “Maybe I’m giving them too much credit,” he said.

ADVERTISEMENT

The real Cohen told The Chronicle in an email that it was lucky no one was fooled or harmed. University staff members alerted other professors about the attempt.

Public listings of department faculty and contact information, though common at many colleges, can be a security vulnerability, said Jason Davis, director of information-technology systems and services at the University of Minnesota at Duluth. Davis said his office has warned professors of these attacks through newsletters and in department meetings.

All the scammers need is to catch a small percentage of targets on an off day because they reach out to so many people, Davis said.

Davis said the scammers have assumed the identity of one particular staff member at Duluth about 15 times.

When Joshua S. Goodman, a pre-tenure associate professor of public policy at Harvard University’s Kennedy School, saw the email at an academic conference a few months ago, he wanted to be helpful to Bridget Terry Long, the dean of Harvard’s Graduate School of Education, whom he thought was contacting him.

ADVERTISEMENT

It felt like an honor to get a note from Long, a scholar he has long admired. He was about to respond before he realized the email wasn’t from her official university address.

“Junior faculty members are constantly thinking, What can I do to make my employer love me and make them keep me for the rest of my life?” he told The Chronicle. “If it’s buying Amazon gift cards, that’s much easier than the tasks I should be doing ... I’d take that deal in an instant.”

Scamming the Scammers

He was at home one Saturday morning in January when he got another email from a fake “Long.” And he wanted to have some fun. (He later posted about the exchange on Twitter.)

“Are you available right now??” the account wrote.

“Yes, what’s up?” he responded.

ADVERTISEMENT

As usual, the fake dean said she was in a meeting where phones couldn’t be used and needed help right away. He said he was happy to help, and she asked for $500 in Amazon gift cards.

“Can’t your administrative assistant help with that?” he wrote.

The impostor pressed on, peppering Goodman with messages. “I will reimburse you back when I get to the office,” read one note. Another: “When you get them, just scratch it and take a picture of them and attach it to the email then send it to me here.”

He expressed concern that she appeared to be in a five-hour-long Saturday meeting. And he wondered how he could be sure it was really her.

“One option,” he wrote, “is you could tell me what you consider to be the single most important finding is in your QJE article on the FAFSA as a barrier to college attendance. I love that paper and feature it prominently on my syllabus.” (The scammer did not venture a guess.)

ADVERTISEMENT

Long later wrote on Twitter that the scammer “most certainly was not me.” But she shared there that the scammers got something right about posing as a dean.

During that Saturday exchange between the scammer and Goodman, the real Long was in fact in a meeting — with other deans, to boot.

Lindsay Ellis is a staff reporter. Follow her on Twitter @lindsayaellis, or email her at lindsay.ellis@chronicle.com.

A version of this article appeared in the February 1, 2019, issue.
We welcome your thoughts and questions about this article. Please email the editors or submit a letter for publication.
Leadership & Governance
Lindsay Ellis
Lindsay Ellis, a reporter at The Wall Street Journal, previously covered research universities, workplace issues, and other topics for The Chronicle.
ADVERTISEMENT
ADVERTISEMENT

Related Content

  • Keeping Up With the Growing Threat to Data Security
  • Explore
    • Get Newsletters
    • Letters
    • Free Reports and Guides
    • Blogs
    • Virtual Events
    • Chronicle Store
    • Find a Job
    Explore
    • Get Newsletters
    • Letters
    • Free Reports and Guides
    • Blogs
    • Virtual Events
    • Chronicle Store
    • Find a Job
  • The Chronicle
    • About Us
    • DEI Commitment Statement
    • Write for Us
    • Talk to Us
    • Work at The Chronicle
    • User Agreement
    • Privacy Policy
    • California Privacy Policy
    • Site Map
    • Accessibility Statement
    The Chronicle
    • About Us
    • DEI Commitment Statement
    • Write for Us
    • Talk to Us
    • Work at The Chronicle
    • User Agreement
    • Privacy Policy
    • California Privacy Policy
    • Site Map
    • Accessibility Statement
  • Customer Assistance
    • Contact Us
    • Advertise With Us
    • Post a Job
    • Advertising Terms and Conditions
    • Reprints & Permissions
    • Do Not Sell My Personal Information
    Customer Assistance
    • Contact Us
    • Advertise With Us
    • Post a Job
    • Advertising Terms and Conditions
    • Reprints & Permissions
    • Do Not Sell My Personal Information
  • Subscribe
    • Individual Subscriptions
    • Institutional Subscriptions
    • Subscription & Account FAQ
    • Manage Newsletters
    • Manage Your Account
    Subscribe
    • Individual Subscriptions
    • Institutional Subscriptions
    • Subscription & Account FAQ
    • Manage Newsletters
    • Manage Your Account
1255 23rd Street, N.W. Washington, D.C. 20037
© 2023 The Chronicle of Higher Education
  • twitter
  • instagram
  • youtube
  • facebook
  • linkedin