Cybercrooks target students with fake job opportunities Scammers appear to be targeting university students looking to kickstart their careers, according to research from cybersecurity biz Proofpoint. From the department of "if it's too good to be true, it probably is" comes a study in which Proofpoint staffers responded to enticement emails to see what would happen. This …
I've recently received several phishing emails for job interviews with presence fees being offered (against filling a webform with my PPI). As I received them on my work mail address, I alerted corporate that phishing emails were finding their way through to our mailboxes. Their only response was "yes, that's a phishing email, you should delete it"
Phishing is standard these days, it's made so realistic because so many companies no longer handle their own emails, they are all using third party servers to send email, publish their web pages, and log into accounts. Very little of the internet is designed to be safe these days, it's just supposed to be easy to use - the cybercrooks appreciate that.
"Very little of the internet is designed to be safe these days"
A lot of it is actively becoming less safe. Notable examples are the growing use of "URL shortening", the prevalence of random-looking character strings (hashes maybe) as the path component of URLs and the Outlook "safelinks" system that wraps URLs in emails in an 'outlook' wrapper and obfuscates the path component. All of them prevent the user identifying what they're about to be served as a result of the click.
The most important security tools are attentiveness and common sense, but they're entirely thwarted by these tricks.
"This time a threat actor pretended to be from an agency seeking models for a Los Angeles shoot. A fake check for $4,950 was emailed as a fee, and $100 in cryptocurrency was requested in order to cover the "shipping" of items needed for the photoshoot."
My daughter got this one, some years ago. Tempting, indeed, but can't say if the check was legit and the 100 bucks were to be paid immediately.
A case of race condition, the time it takes you to realize the check is fake, the 100 bucks are gone ...
These are university students that are targeted. If they fall for this crap, then you gotta scratch your head a bit... These are people supposed to be more clever than the average, are they not? Maybe computers do dumb us down too much. Then we deserve what we get.
Being educated in an academic subject doesn't mean you've been taught to survive on the street. Or on the Internet.
Different skills, different approaches. Highly intelligent people do fall for scams, and often haven't encountered the mindsets and learn the suspicions that help avoid them.
I was just about to write that. A specialized skill-set, and competence is to a large extent domain specific.
IIRC there is more than one Nobel laureate that has fallen for scams, and I think most of them would be counted for smart by any sensible standard. But few of them are trained and experienced in catching scams and understanding the dynamics of cons.
It's much simpler than that. The old saying goes that you can't con an honest man. The problem isn't so much that these students are stupid as that their greed outpaces their intelligence. Anyone who stops and thinks about these scams, or bothers to do even 30 seconds of research, will know they're going to lose money. But greedy people are greedy: they want that quick, easy money. Those who allow that impulse to outrun their analytical minds will keep falling for these simple grifts. Those who were raised to expect to have to give value in order to get value will be immediately suspicious.
The real reason these scams work is as old as humanity. The real reasons they are more likely to work now than in the past have nothing to do with the fashion of working from home, language proficiency, or inflation. In many developed countries, the last 2 or 3 generations have been raised to believe they are entitled to wealth regardless of whether they engage in value creation. The more people are raised with that ideology, the more of them will interpret the "too good to be true" scam as a legitimate offer. After all, politicians have been offering people money for nothing since the 1930s and getting elected! If they're legit, surely the scam offer is too.
"The old saying goes that you can't con an honest man."
That's a great saying, honest men repeating that to each other makes them easier marks. One confidence book I read had a very different saying, that the easiest mark is one who believes he is perfectly honest. So, if you want to con a saint, you offer them a too-good-to-be-true opportunity to help the orphans, or whatever. Think of the children!
What makes people vulnerable to a con is lack of experience. Of course if you protect people too much, they don't acquire any experience. It reminds me of the old sysadmins who were against aliasing rm to something safer because making things safer just made users more careless.
I prefer to learn from other people's experience, by reading. But the way the brain works, or not works, sometimes there is no substitute for the real thing.
"So, if you want to con a saint, you offer them a too-good-to-be-true opportunity to help the orphans, or whatever."
Being honest has nothing to do with saintly intentions, either. Value received must be earned; if you want to help orphans, you have to earn the ability to do so. There's no free lunch for the object of your charitable intentions any more than for you. Witness the periodic charity scams: "We've made it so you can donate to help XXX victims in ZZZland with no fees and just a single click! Click here to donate now!" The reality is that getting needed goods and services to people in a war zone or disaster area is expensive and dangerous. Real charities are transparent about how much of their income they spend on that kind of overhead and market themselves based on the experience, reach, and capabilities that make their activities more effective than others'. Scammers on the other hand make unbelievable claims that cater to a desire for instant gratification and getting something for nothing. The desire to help others is in this regard no different from the usual desire to help oneself: if all the value seems to be flowing in one direction, it's not an honest deal.
That's a very easy and wrong explanation. No, it doesn't come down to greed, any more than you wanting to be paid does. Students want job experience, and in many cases, it's hard to get because they don't yet have the ability to write a lot on their CV. Getting a job offer is something they're trying for all the time, so the scam starts by playing on that emotion. In these cases, the students aren't expecting free money; they're expecting that a company or organization wants work done and thinks they're qualified to do it. The student, at this point, is perfectly willing to provide value and expects to do so in return for this paycheck.
As I've established, greed isn't required to fall for the fake job offer. How about the fake check that comes later? It's still not greed. A greedy student would want to cash the check and either not give the company anything or find out how to get more checks. A student who doesn't know how these things work would want to follow instructions, assuming their weirdness sensor hasn't gone off yet. We know that a company won't start off this way, but a student with no real job experience except basic jobs doesn't. After all, while we wouldn't expect to be given a check then asked to send money on, there are companies that ask people to pay for expenses and submit an expense report to have the money returned to them, and that's perfectly normal. It takes a bit of credulity and a lack of experience. Greed would only hamper the process. I think you're jumping to blame the victim is not only needlessly disparaging to them but also gets the facts wrong.
Taking someone's work and refusing to pay them (paying with a fake check) is simply theft, not grift. But there's no good reason for someone to take such a job instead of a legitimate one unless some kind of unusually juicy terms are on offer. It might be an overly generous WFH equipment allowance, or it might be a title beyond the mark's true level of experience. The mark is greedy for something: a fancy posting to add to their cv, more money, something that has not been earned. Why would someone just out of university expect to be hired into an executive position at UNICEF? And at a market wage or better, no less, when it's well known that NGOs pay significantly less than private-sector employers?
You've as much as admitted this: "they don't yet have the ability to write a lot on their CV. Getting a job offer is something they're trying for all the time, so the scam starts by playing on that emotion". That's the greed! They don't have any experience, just a degree that is now so nearly universal as to be almost worthless. Yes, someone will be willing to hire them, but it's going to be an entry-level position paying an entry-level wage with an entry-level title. Because that's the career stage they're at! Expecting more and believing anyone is going to offer more is greedy, or at best vanity and pride (sorry, kid, you're not special; get in line with the rest of us). Greed needn't be for cash, it can as well be the desire to avoid putting in the time and paying one's dues, or for someone to cater to vanity, or for anything else unearned.
As for "blaming the victim", I am assigning exclusive and total blame to each party for its own actions. The victim is guilty of greed. That isn't a crime, but we shouldn't be excusing or rewarding it, either. The scammer is guilty of theft, or of fraud, or both. Those are crimes. They should be punished. But the crime requires the victim's complicity to carry off. When we refuse to acknowledge that, we lose our best means of prevention.
Right, you have a strange idea of how students and these scams work.
"The mark is greedy for something: a fancy posting to add to their cv, more money, something that has not been earned.": No, they want those things, just like you would like to be paid. You earned your paycheck, didn't you? They think they're going to earn theirs.
"Why would someone just out of university expect to be hired into an executive position at UNICEF? And at a market wage or better, no less, when it's well known that NGOs pay significantly less than private-sector employers?"
They don't. Did you read the article? The job title on offer was "Executive Personal Assistant", as in assisting someone else who has an executive position. That's an entry level job, requiring little educational experience.
"Yes, someone will be willing to hire them, but it's going to be an entry-level position paying an entry-level wage with an entry-level title. Because that's the career stage they're at! Expecting more and believing anyone is going to offer more is greedy, or at best vanity and pride"
They are expecting an entry-level job with all the stuff that comes with that, and if they were not, it's not greedy. I had a nice job as a programmer when I had my degree. Does it make me greedy to have applied for and gotten a better-paid job?
"Greed needn't be for cash, it can as well be the desire to avoid putting in the time and paying one's dues, or for someone to cater to vanity, or for anything else unearned."
You just made up the whole "unearned" business. The students didn't expect to get something without doing work. It's a job offer, and those who accepted it expected to be asked to work for their wages.
"As for "blaming the victim", I am assigning exclusive and total blame to each party for its own actions. The victim is guilty of greed. That isn't a crime, but we shouldn't be excusing or rewarding it, either."
Who is rewarding anyone for this? And you are blaming the victim by assigning them a motive that clearly isn't supported by the situation.
We live in a world of lots of random and at times stupid things. Raw intelligence, assuming that's what you find in every university student, doesn't teach you all of those things. No matter how many complex mathematical theories you can correctly use, prove, and expand upon, you still might not know how to spot someone taking advantage of you. They're separate sets of knowledge, and you'll only learn each by experience and attention to that one specifically. We don't even have to go that far--we all know people who can be incredibly skilled at one thing that's taught at a school and terrible at another, like someone who can write a bulletproof compiler in a week and couldn't write a readme for it that anyone could understand.
And of course, not every university student is a genius. There are a lot of people there who won't score top of the class and many of them aren't planning to. This doesn't mean they're idiots. It means they don't have the same goals as we probably did while there. They're there to gain experience, and falling for this will be a very painful but educational experience indeed. Of course, it would be nicer if they could learn about the scam without falling for it, but that happens too.
There are few relevant points here. Firstly, no, students are not really supposed to be more clever than the average. You can get a degree in David Beckham studies, or media studies, or golf management, or all kinds of other things that don't imply or require any particular level of intelligence. Universities offer a particular type of education in particular subjects, but there's no assumption of particularly high intelligence across the majority of attendees. That's not even really a new thing. The idea of universities consisting of high-minded academics living in ivory towers was never true, in the old days it was often just a place to ship off spare children who might be needed as backup heirs and so weren't suitable for the clergy. Intelligence in students has often been the ideal, but rarely been the case in practice.
Secondly, the defining feature of students is that they do not, in fact, yet have much of an educational level. The entire point of going to university is to drink learn. Complaining that people specifically attempting to gain an education do not yet have an education is a bit silly.
Thirdly, one word - teenagers. The majority of people in this country go to university aged 18 or 19. If you're looking for a group of people to act in a sensible, rational manner, teenaged students would be just about the worst possible choice.
Finally, it's not greed if they really do need the money. Students as a whole tend to have no savings, no income, and have been forced to go into massive debt to the tune of tens of thousands of pounds, facing the very real prospect of remaining in debt for their entire life as a result. It's hardly surprising that some of them might jump at the chance of making some easy money.
Overall, it would be difficult to find a more perfect target. Dirt poor, uneducated, immature teenagers out on their own for the first time with no idea how the real world works but with a desperate need to find money somewhere. If we weren't already familiar with the concept of students, no scammer would believe you if you tried to invent such a perfect class of victims.
This post has been deleted by its author
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
