University of Toronto Scarborough gets phished

On November 7th a phishing email message with the subject line “ACE organic online homework” was sent to over 12,000 students at University of Toronto at Scarborough mailing list.

From the title of the message it is clear that the email specifically targeted students and was sent with the intent to illegally obtain sensitive financial information. A notice concerning the message was sent to all students by Tom Nowers, the dean of student affairs.

There are currently no suspects at this time although an investigation is underway. Thankfully, no students reported any losses.

“I just deleted it,” said Ikennah Brown a UTSC student. His statement was echoed by most other students who were asked. However, some students preferred to be more vocal.
“We got a number of complaints about this one message,” Nowers said.

While email scams such as this are commonplace on the internet the notice described the “unauthorized violation of computer privileges” as a “first-time ever glitch”.

“This is the first time it’s ever happened in 10 years that I’ve been here,” Nowers said.

The email in question advertises various medications at extremely low prices. A link is provided which redirects the user to a site selling mostly male enhancement pills. The site, which is fake, lists a single pill of Viagra for as little as $0.66 USD. Ordinarily these types of medication run from $10-$30 per tablet.  

Once the user is ready they need only click their selection and enter their credit card information to place an order just as they would on any other website. Unfortunately for the user, the order never arrives and all they have successfully done is provided a scam artist with their credit card number.

According to the office of the privacy commissioner thousands of Canadians fall victim to identity theft every year.

“It’s certainly far beyond the resources of the university police,” said Robert Messacar, manager of the community police at UTSC.

Policing the internet is particularly difficult especially in phishing schemes where the crimes usually cross jurisdictional boundaries. Some take the scams a step further by forcing an innocent person’s email to forward the phishing scheme to all of their contacts.

Sepehr Hesam, a video editor, had his computer infected two months ago. Since then he has been getting calls and messages from his friends telling him they keep receiving suspicious emails from his address. In his case the message links to a site advertising name brand electronics at dirt cheap prices. He worries about inadvertently harming not only his friends but his professional contacts as well.

“It’s a huge inconvenience,” says Hesam, whose father was once the victim of credit card fraud. “I was thinking of deleting my hotmail account today.”

In Canada, convictions of fraud or identity theft usually carry a jail sentence ranging from a couple of months to a couple of years.

Those who fall victim to identity theft are urged to contact both the police and credit bureau immediately. Any reports of stolen information should be followed up in writing.

Nowers assures students that John Harper, IT systems manager for UTSC, has

“reprogrammed the software.”

 “Never send personal information over the internet…ever,” advises Messacar. “It’s the old story. If something sounds too good to be true, it’s too good to be true.”