Brown Student Job

Phish Bowl Alerts

Watch out for this clever job scam that looks like it was sent by the Payroll Office (clue #1 - why would the Payroll Office send job notices?), but examination of the headers details shows the identity of the actual sender. If you receive an email from what looks like a familiar name but doesn't seem quite right, check the header details to be sure. Read Trace an email with its full headers to learn how.

How did the scammer do it? See the explanation after the example email.

From: Payroll Office <specialist_payroll@brown.edu> [actual sender from header details - davidh@affinitytv247.com]
Date: Mon, May 17, 2021 at 3:16 PM
Subject: Brown Student Job
To:

Brown University is currently hiring and seeking the service of a
competent students to work remotely as Research assistants, give Clerical
Support and get paid $350 weekly. To proceed with the application process
submit your full name, functional phone number to [REDACTED]
to receive the job description and further information.

Best Regards
Dr, Tyler Campbell
Assistant Professor
tyler_campbell@brown.edu
(443) 437-4263

See the highlighted FROM field below, where the scammer included the imposter email address as part of the name.

Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="utf-8"
User-Agent: Workspace Webmail 6.12.7
Message-Id: <20210517121608.37ae20bf164eb47a912028e07b4c628d.3d543b83b2.wbe@email09.g...>
From: Payroll Office <specialist_payroll@brown.edu>
To:
Subject: Brown Student Job
Date: Mon, 17 May 2021 12:16:08 -0700