On Jan. 9, the City of Corvallis was victim to a phishing scam, compromising the email of Paul Schuffer, Ward 7 City Councilor and Council President.

City of Corvallis Public Information Officer Patrick Rollens said that for the City of Corvallis, around 3,408 accounts were sent a phishing email from Schuffer’s email.

“A number of those email addresses appear to be generic/unmonitored email addresses associated with mailing lists, so the actual number of individual people affected is probably a lot lower than 3,408,” Rollens said.

Schuffer has since regained control of his email, according to Rollens.

The Merriam-Webster Dictionary defines phishing as “the practice of tricking Internet users (as through the use of deceptive email messages or websites) into revealing personal or confidential information which can then be used illicitly.”

According to David McMorries, chief information security officer at OSU, the email from the City of Corvallis is very similar to emails that students at Oregon State University would receive, and “tens of thousands” of these emails get sent out every year to students and faculty alike.

The type of phishing that is most common for students is the employment fraud scam according to McMorries. During these scams, someone would pretend to be a school administrator and offer students a job. This would typically include some “easy work” and offer $2,000 to $3,000 a term.

“This is very attractive to students,” McMorries said. “But if you see what the email is asking you to do, it could also be a (scam) indicator.”

McMorries said the school has been seeing a lot of emails with QR codes and emails sending you to external cloud service links not from OSU.

McMorries said that some dead giveaways of phishing scams are asking you to send them a personal email address, personal cell phone number or your banking information so they can deposit money into your account.

“Typically, an official OSU email will not ask you to do these sorts of things,” McMorries said. “If there is a communication from your college or administrators, they’ll normally direct you to an OSU website or some legitimate source of information.”

One of the security measures that OSU has taken against phishing scams is moving student emails from Gmail to Microsoft 365.

“One of the reasons we did this was because students were being so targeted and we couldn’t do anything about it,” McMorries said.

According to McMorries, OSU can see these phishing emails and Microsoft 365 handles many of the really obvious ones. Some of these emails still get through. McMorries wants the general OSU public to report them so that these emails get sent to his team.

“We can actually take action to remove those emails from student inboxes,” McMorries said. “So what I encourage people to do is when they see something that looks suspicious, report it, and then let the security operations center take some action to see if they can mitigate the threat and reduce the problem for students.”

“No one asked to get phished, so help us protect you,” McMorries said. “Report them and if you happen to click on something you shouldn’t, please let somebody know and let us help you get back to being a productive OSU community member.”