Beware of gift card and sextortion email scams

Two recent phishing scams have targeted numerous Stanford community members, leading to financial loss in several cases. The Information Security Office is alerting the community while actively working to flag such messages as suspicious.

Gift card scam

The gift card scam lures employees into buying gift cards through spoofed text messages and emails. It begins with a short conversational message such as “Are you there?” that appears to be from a Stanford colleague, but is actually sent from the scammer’s email account. If the recipient responds, the scammer will reply, and the conversation quickly turns into a request to purchase gift cards.

Any time an unsolicited email conversation turns into a request to purchase gift cards, it is very likely to be this scam. If this happens, discontinue the conversation and forward the message to spam@stanford.edu.

You can also protect yourself from this scam by carefully examining the sender’s email address. If it differs from the sender’s normal address, stop and forward the message to spam@stanford.edu. If unsure, contact the purported sender via a different means.

Sextortion scam

The sextortion scam begins with an email sent to the victim with threats of revealing evidence of embarrassing online activity such as visiting pornographic websites. The sender may claim to have screenshots or webcam video of the activity, along with contact information of friends, family and colleagues. This is often accompanied by a password used by the victim that has been obtained through external data breaches, leading the victim to believe that his/her Stanford account has been compromised. The scammer will then demand payment in exchange for not revealing the embarrassing activity.

Despite the scammer’s claims, instances of this particular scam have proven to be empty threats, and the sender does not actually have the purported embarrassing information. If you are concerned your computer has been compromised, contact your IT support to have it examined. If you receive such a message, do not respond and do not click on any links in the message. Instead, forward the message to spam@stanford.edu.