Brown Student Job

Watch out for this clever job scam that looks like it was sent by the Payroll Office (clue #1 - why would the Payroll Office send job notices?), but examination of the headers details shows the identity of the actual sender. If you receive an email from what looks like a familiar name but doesn't seem quite right, check the header details to be sure. Read Trace an email with its full headers to learn how.

How did the scammer do it? See the explanation after the example email.


From: Payroll Office <specialist_payroll@brown.edu> [actual sender from header details - davidh@affinitytv247.com]
Date: Mon, May 17, 2021 at 3:16 PM
Subject: Brown Student Job
To:

Brown University is currently hiring and seeking the service of a
competent students to work remotely as Research assistants, give Clerical
Support and get paid $350 weekly. To proceed with the application process
submit your full name, functional phone number to [REDACTED]
to receive the job description and further information.

Best Regards
Dr, Tyler Campbell
Assistant Professor
tyler_campbell@brown.edu
(443) 437-4263


See the highlighted FROM field below, where  the scammer included the imposter email address as part of the name.

Received: (qmail 31605 invoked by uid 99); 17 May 2021 19:16:10 -0000
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="utf-8"
X-Originating-IP: 192.142.128.171
User-Agent: Workspace Webmail 6.12.7
Message-Id: <20210517121608.37ae20bf164eb47a912028e07b4c628d.3d543b83b2.wbe@email09.g...>
From: Payroll Office <specialist_payroll@brown.edu>
X-Sender: davidh@affinitytv247.com
To: 
Subject: Brown Student Job
Date: Mon, 17 May 2021 12:16:08 -0700

Phishing
Phishing Email (on campus)

Written by pfalcon@brown.edu on