Texas Tech University.
TTU Home Safe Computing Practices Critical Topics
logo small

E-mail Scams and Hoaxes

Email

Reach out with caution

We have all received a hoax or scam email message. Many have lost money to bogus offers, fraudulent sales, and counterfeit charity causes that arrived as spam in their inbox. Knowing how to recognize email fraud and educating yourself about current hoaxes and scams can help you avoid becoming a victim. 

Common Email Fraud Characteristics:

The Threat

Hoaxes

Internet hoaxes and chain letters are e-mail messages written with one purpose; to be sent to everyone you know. The messages they contain are usually untrue. A few of the sympathy messages do describe a real situation but that situation was resolved years ago so the message is not valid and has not been valid for many years. Hoax messages try to get you to pass them on to everyone you know using several different methods of social engineering.

Chain letters are lumped in with the hoax messages because they have the same purpose as the hoax messages but use a slightly different method of coercing you into passing them on to everyone you know. Chain letters, like their printed ancestors, generally offer luck or money if you send them on. They play on your fear of bad luck and the realization that it is almost trivial for you to send them on. The chain letters that deal in money play on people's greed and are illegal no matter what they say in the letter.

Virus hoaxes are more than mere annoyances, as they may lead some users to routinely ignore all virus warning messages, leaving them vulnerable to a genuine, destructive virus. The next time you receive an urgent virus warning message via email, be sure to check a list of known virus hoaxes. Remember: Never open an email attachment unless you know what it is--even if it's from someone you know and trust. Also, remember that virus writers can use known hoaxes to their advantage. For example, the AOL4FREE virus began as a hoax virus warning but then somebody distributed a destructive Trojan attached to the original hoax virus warning.

Scams

Scams are becoming more common on the Internet as time passes, with the criminals behind them constantly devising new ways to part you from your money. Below we provide you with some basic ways to identify a scam and some tip to prevent you from being caught in one.

Email scams and hoaxes pose the following threats:

  • Contains an unexpected file to open or download.
  • Contains a Link/URL to a company for you to correct or enter personal information.
  • Contains information suggesting you delete a file from a "known" virus.
  • Contains a Link/URL to purchase discount pharmaceuticals or name brand software.

These are all designed to trick you into infecting your computer, disclosing personal information, confirming a valid email address for future spam, or deleting an important system file to render your machine inoperable.

Recognizing Online Scams and Fraud

  • Big Promises
    Claims such as "Make money in your spare time," "Earn thousands per week!" or "guaranteed income" are almost always sure signs of a scam. Excellent opportunities sell themselves, they don't need to be sold to you through big time pressure and promises of riches.
  • High Pressure Tactics
    For example, "sign up now or the price will increase." Again, a legitimate deal probably isn't going to move as fast as your money. Don't let yourself be pressured, think things through. It's no different than dealing with door to door salespeople.
  • Prizes
    Promises of prizes and money almost always come with catches, or are blatant lies. Watch in particular for "prizes" where you have to pay something up front to claim it (that includes postage fees).
  • Requests for financial information
    There are only a few real reasons anyone could need your credit card number, the main one being that you are making an online purchase. If so, ensure it is a reputable merchant and that the information is being encrypted. Some sites claim to need credit card numbers as proof of age. A credit card number is not proof of age, and credit card theft on the Internet using these tactics is skyrocketing. Do not give your number out if you don't know exactly who you are giving it to and have a means of recourse if something goes wrong. See the online shopping section for more.
  • The word "FREE."
    When you see the word Free, you should expect a catch, if not outright lying. Always view this word warily, especially when it shows up in Spam and on un-reputable websites. Some sites will offer you access to content for "free" if you provide a credit card number as proof of age. As stated above, a credit card number is not proof of age and what the number could be used for once you give it up is probably NOT worth the risk.
  • Having to send money before receiving a product
    This is particularly the case with Online Auctions. Take extreme caution when participating in Internet Auctions, and be sure to use an escrow service. Auctions comprise the most commonly reported method of Internet fraud. For an excellent brief on other methods of Fraud and signs to look for, visit the Federal Trade Commission's consumer protection pages.
  • Finally, remember the old saying, "if it sounds to good to be true, it probably is."

The bottom line is that no reputable financial organization, corporation, or organization will request sensitive information from you via electronic mail. Your best defense is the delete button and effective utilization of spam filters.

Common Hoaxes and Scams:

To avoid being a victim of email fraud, follow these tips:

Current lists of hoaxes, scams, and other vulnerabilities can be found at:

E-mail Spoofing

Spammers and hackers are using e-mail address “spoofing” to appear as though a message has been sent from a Texas Tech University (@ttu.edu) address when the message actually originates from a non-TTU mail server. A typical ploy is a message that appears to be from “Admin@ttu.edu,” indicating that an account is expiring and that the reader should open an attachment to prevent expiration.

Spammers and hackers are now using e-mail address spoofing to transmit viruses and install spyware. To minimize this security threat to the University community, TechMail servers are configured not to accept messages sent from non-TTU e-mail servers, such as AOL, MSN, Yahoo, Cox, and other ISP mail servers, when the address in the “From” field is a TechMail address.

Three types of messages sent to TechMail servers that are impacted:

If you have any questions or for additional information, please contact IT Help Central at 742-HELP(4357).

Recommended Practices

  1. Never open an email attachment unless you know what it is, even if it's from someone you know and trust.
  2. Virus writers can attach a virus into the hoax so when a user opens up the file they also open up the file with the virus attachment.
  3. Never UnZip any files that you are not expecting.
    • Be cautious even if you know the sender.
    • Always double check with the sender and know what it is you are opening.
  4. Be familiar with the Hoax Lists:
  5. Be familiar with the Scam List:

Email Password Tips

Selecting a secure password is a critical component in practicing safe computing. While it may be convenient to select a password that is an easy word or information that you have to remember for other purposes, such passwords are typically not secure and can put your privacy and information at risk. To assist you with selecting secure passwords, please use the following password practices:

In addition, please use the following criteria to create "strong" passwords:

Passwords must not be easy to guess and they must not be your:

Passwords must not be:

Other common passwords to avoid include:

The IT Division suggests the following additional tips:

TTU TechMail Filters

The TTU IT Division runs a sophisticated TechMail system that includes software that "scores" each incoming e-mail message. Those messages that are deemed "suspect" are automatically delivered to your "Junk E-mail" folder. The scoring mechanism is updated according to industry standards, on a regular basis. Given that no scoring mechanism is perfect, occasionally a legitimate message is marked as "suspect" and sent to junk e-mail. If we elected to automatically delete "suspect" e-mail messages, which the industry refers to as "censorship," then you would never have the opportunity to review all e-mail sent to your address.

In addition to directing "suspect" e-mail to your "Junk E-mail" folder, the IT Division also takes the following actions to reduce malicious spam:

For those of you using TechMail, the IT Division recently implemented a server-based solution to help manage spam by placing suspect e-mails directly in your "Junk E-mail" folder for you to review. Suspect e-mails are only deleted after your review, giving you full control of any e-mail you receive. The most powerful spam management comes from settings within your e-mail software. You can reduce your spam by implementing the following practices:

General Recommendations

Customizing Your Junk E-Mail

  1. Configuring Junk E-Mail Filters in Outlook 2003: Enable Cached Exchange Mode
    (Note: Cached Exchange Mode creates a self-synchronized copy of your messages that are stored on both the server and your client.)
    1. On the "Tools" menu, select "E-Mail Accounts."
    2. You will now see the E-Mail Accounts Wizard window. Select "View or change existing e-mail accounts" and click "Next."
    3. The E-Mail Accounts window will now appear. Select "Microsoft Exchange Server" and click the "Change" button.
    4. The Exchange Server Settings window will now appear. Check the box next to "Use Cached Exchange Mode" and then click "Next."
    5. Now click the "Finish" button.
    6. You must now exit and then reopen Outlook 2003 to continue.
  2. Change Junk E-Mail settings in Outlook 2003
    1. On the "Tools" menu, select "Options."
    2. In the "Options" dialog box, click on the "Junk E-mail" button.
    3. Choose the level of junk e-mail message protection you want and click "OK."
  3. Add a sender to your Safe Senders List, Safe Recipients Lists, or Blocked Senders List:
    1. Right-click on a message from the sender.
    2. Point to "Junk E-mail," and click either "Add Sender to Safe Senders List," "Add Sender to Blocked Senders List," or "Add Recipient to Safe Recipients Lists."
    3. The first time Outlook 2003 moves a message to the Junk E-mail folder, it will notify you with a dialog box.

IT Help Central will be glad to assist with your TechMail Junk e-mail settings. Visit http://www.helpdesk.ttu.edu/info/antispam.php for instructions on setting up your spam filters.