Scammers target new students by hijacking legitimate US university emails

Scammers are targeting new college students by hijacking legitimate .edu university email accounts to spread fake job offers and gift card scams. Victims are asked to verify their email address, which leads to them sharing their passwords. The scammers then use the compromised account to send a second phishing email to the victim's contacts, advertising a fake job opportunity.

They are then given a check for $1,000 to deposit, instructed to keep half as their salary and purchase gift cards with the remaining half, which they send back to the scammers. The checks are fraudulent, leaving the victim $500 short once the bank reverses the deposit. Cybercriminals from Nigeria are behind the operation, targeting college students who may have less experience with email correspondence and active email accounts.

The scammers use the authority of the .edu TLD to lend credibility to their scams and lure victims with fake job offers. If a victim does not follow the instructions, the scammers become aggressive, pretending to be FBI agents and threatening legal action.