CoreStaff Phishing Scheme: A Dialogue between Scammer and Victim

Ever wonder what might happen if you responded to a phishing email, such as the one reported last week from CoreStaff Services? The following is an anonymized example of someone who did, and was willing to share it, so that Phish Bowl readers can learn how a phishing hook is set, and a victim is reeled in.

For a firsthand account, you can also watch a video by a student at Rutgers University who was caught up in the scheme for a bit, became dubious, then played along to learn more.

Related resources:
> Job Scams
Mind your work-at-home business
How to Spot, Avoid and Report Fake Check Scams
That $10,000 check in the mail is likely just a scam. Here's how to avoid falling victim


#1 - This is the initial invitation reported to the Phish Bowl.

From: Marion Wasser <wasserm226@gmail.com>
Date: Fri, Apr 17, 2020 at 5:45 PM
Subject: BROWN STUDENT REMOTE PART TIME JOB OFFER
To: <josiah_carberry@brown.edu>

--
Dear Student,

We got your contact through your school database and I'm happy to inform you that our reputable company CORESTAFF SERVICES Inc®, is currently running a student empowerment programme. This programme is to help loyal and hardworking students like you secure a remote part-time job which does not deter you from doing any other, you just need a few hours to do this weekly and with an attractive weekly wage. 

FOR MORE INQUIRES ABOUT THIS JOB OPENING. KINDLY TEXT " INTERESTED " TO  ‪206-333-7259 .

Kind Regards,

Marion Wasser
HR Dept/Consultant
CORESTAFF SERVICES Inc®


#2 - Here is CoreStaff's reply after Josiah's response to the invitation.

On Mon, Apr 20, 2020 at 10:56 AM "CORESTAFF SERVICES Inc®" <corestaff@consultant.com> wrote:
Dear Josiah,
 
I am happy to inform you that your application has now been processed and approved. We are presently in the process of reviewing each applicant's details but due to the high level of interest in the position, we will not be able to interview every applicant. You will be getting paid weekly and you are entitled to $300 only as stated in the advert.
 
We will mail you a money order or cashie's check to cover your start up wages which will also include money for you to carry out your first assignment. You will be properly briefed in order to carry out every task appropriately along with the complete funds to cover them. I believe we started this with TRUST, HONESTY AND SOUND MIND!
 
NOTE: YOUR IMMEDIATE RESPONSE TO THIS EMAIL IS EXPECTED, AFTER WHICH, YOU SHALL RECEIVE YOUR ASSIGNMENT AND INSTRUCTION.
 
A SUPERVISOR HAS ALSO BEEN ASSIGNED TO GUIDE YOU SO MAKE SURE YOU CHECK YOUR E-MAIL AND PHONE MESSAGES DAILY.
 
Best regards,
 
Devon Baynard 
Sr. Recruiting & Account Manager
Corestaff Services Inc®


#3 - This is the follow-up email from CoreStaff after Josiah accepted the offered position. A couple of things to note in this email is the grammatical error in the first sentence of the second paragraph (it isn't actually a sentence since it has no verb); the word stationery is misspelled; the extra period at the end of the thrid paragraph; and the awkward phrasing in the last paragraph. Professional businesses wouldn't let something like this slip by them.

From: "CORESTAFF SERVICES Inc®" <corestaff@consultant.com>
To: Josiah Carberry <josiah_carberry@brown.edu>
Date: Mon, Apr 20, 2:26 PM 
Subject: Let's get started, Josiah!

Dear Josiah,
 
Welcome to our Team from us all at CORESTAFF! This is a remote part-time job and we have many partners, different departments and are being managed by different staff. This empowerment programme was designed to help loyal and hardworking students like you secure a part-time job and no experience is needed.
 
This empowerment program in conjunction with PATHWAY and other governmental agencies to help prospective students gain experience in the work field. We are currently open to all students and have limited interview barriers to interested students. And as stated in the job description, this job does not deter you from doing any other. You just need a few hours of your time to do this weekly and you can have your own part of the work completed in your leisure time in school or at home.
 
The supplies are envelopes, files, stamps and other stationery items.  As a recruit, your primary job obligation is to order the required stationary from https://www.officesupply.com, make payment with the funds (paycheck which will always include your weekly earnings) you would be receiving weekly, have the items shipped and monitored until it gets to the agent's address and then write a report on the specific items ordered/how many of each/the total costs..
 
There are several payment options available to make payment for your orders, e.g Visa, MasterCard, Discover, American Express, Cashapp, Zelle, Walmart, Paypal, Money Orders, and Cashiers Checks. Also, your assigned supervisor will always guide you with templates so you have absolutely nothing to worry about.
 
We sincerely hope you understand that and get accustomed to the task ahead. Also, kindly let me know if you have any questions.
 
Best regards,
 
Devon Baynard 
Sr. Recruiting & Account Manager


#4 - What's suspicious here?  Why would they send the paycheck before any work is completed? Also, there is a missing word (when) in the last sentence. Again, a careless mistake for a professional business.

From: "CORESTAFF SERVICES Inc®" <corestaff@consultant.com>
To: Josiah Carberry <josiah_carberry@brown.edu>
Date: Wed, Apr 22, 6:12 PM
Subject: PAYCHECK MAILED-OUT

Dear Josiah,
 
This is to inform you that the paycheck which will cover your first assignment and first-week earnings has been mailed out and it will be delivered by UPS on or before Friday.
 
Here is the tracking # 1Z6A8T000190124886. Please look it up at www.ups.com and kindly notify me immediately you receive it and I can give you further instructions if your assigned supervisor hasn't contacted you yet.
 
Best Regards
 
Devon Baynard 
Sr. Recruiting & Account Manager
Corestaff Services Inc®


#5 - Later in the week, after the check was delivered to Josiah, CoreStaff sent this email. Not only is it strange to require how the check should be deposited, but the directions are in a rambling, run-on sentence. The next paragraph contains an abbreviation of account ("acct") and not the full word for some reason, and a hypenated instance of "within".

From: "CORESTAFF SERVICES Inc®" <corestaff@consultant.com>
To: Josiah Carberry <josiah_carberry@brown.edu>
Date: Thu, Apr 23, 10:42 AM
Subject: PAYCHECK DELIVERED

Dear Josiah,
 
We just received a notification message from UPS that the item has been delivered and here is the confirmation message: Delivered To PROVIDENCE, RI, US. Left At: Receiver.
 
Once you have the check, kindly proceed to deposit it via your Bank's Mobile App, via ATM because it is faster to be verified and cleared and saves you a trip to the bank but if you prefer going to the bank, you can do that.
 
And since it is an out of state cashier's check, you must deposit it for security reason so that it could be verified, cleared and fully settled in your bank acct. If that's done, the funds would then be available in your bank acct with-in 24 hrs.
 
Kindly take a picture of the deposit slip receipt and send via e-mail. It is important for our records. 
 
Sincerely,
 
Devon Baynard 
Sr. Recruiting & Account Manager
Corestaff Services Inc®


#6 - This last section is the interchange that occurred after the check was received and CoreStaff had put the pressure on Josiah to acknowledge texts and purchase the office supplies as instructed. A notification from BoA has been included in this thread with some details excised.

What occurred after this point, is that Josiah purchased a large amount of office supplies ($1,700) worth, then learned from his bank that the check was no good and he had lost the money. We recommended that he not only contact Public Safety about this crime but also:

======================
On Fri, Apr 24, 2020 at 8:51 AM "CORESTAFF SERVICES Inc®" <corestaff@consultant.com> wrote:
Hello Josiah,
 
I hope you're having a good morning? We believe the funds must be fully settled by now and be made available to you. kindly confirm with your bank as soon as possible. 
 
Awaiting your feedback,
 
Regards,
 
Devon Baynard 
Sr. Recruiting & Account Manager
Corestaff Services Inc®

======================
Sent: Friday, April 24, 2020 at 10:16 AM
From: "Carberry, Josiah" <josiah_carberry@brown.edu>
To: "CORESTAFF SERVICES Inc®" <corestaff@consultant.com>
Subject: Re: We received your mobile check deposit

Yes, I have received it.
And the funds are available now. 
Could you give me information on what I should order? Thank you.

======================
Sent: Thursday, April 23, 2020 at 10:40 AM
From: "Carberry, Josiah" <josiah_carberry@brown.edu>
To: "CORESTAFF SERVICES Inc®" <corestaff@consultant.com>
Subject: Fwd: We received your mobile check deposit

Hi, I just received the check and it is being processed by my bank.

======================
From: Bank of America <onlinebanking@ealerts.bankofamerica.com>
Date: Thu, Apr 23, 2020 at 11:39 AM
Subject: We received your mobile check deposit
To: <josiah_carberry@brown.edu>
 
We received your mobile check deposit
Check amount: $1,700.00
To: Adv Plus Banking 1674
Credit posts on: April 23, 2020
Available now: $0.00
Confirmation #:  XXXXXXXXX

Important information:

  • Keep the check for one week. Since this is a signed check, keep it in a safe place and then destroy it so it can't be re-presented.
  • Deposit funds are generally available the next business day (Monday-Friday, except bank holidays)
  • You can save or print a copy of the check for your records in the app
  • We'll never ask for your personal information such as SSN or ATM PIN in email messages. If you get an email that looks suspicious or you are not the intended recipient of this email, don't click on any links. Instead, forward to abuse@bankofamerica.com then delete it.

======================
"CORESTAFF SERVICES Inc®" <corestaff@consultant.com>
Fri, Apr 24, 12:14 PM (3 days ago)
to carberry, josiah

Hello Josiah,
 
Good to know the funds are available now. 
 
Your supervisor "Jayesh Bandi" just reported that he has been texting you but he is not getting anything back from you. 
 
You need to respond to our text messages, he is the personnel attached to you for this initial period of probation.
 
So now, Mr. Jayesh Bandi will take it from here via the text messages medium.  
 
Thanks and best regards,

Devon Baynard 
Sr. Recruiting & Account Manager
Corestaff Services Inc®

Phishing
Phishing Email (on campus)

Written by pfalcon@brown.edu on