Protecting students and staff from COVID-19 scams

As the current situation of the novel coronavirus unfolds worldwide, new forms of scam and fraudulent activities are threatening students, academic faculty and administrative staff. Scammers are profiting from the COVID-19 crisis as some individuals may be in a vulnerable position due to fear, misinformation and uncertainty.

Spotting online scams and phishing emails

McGill University in Canada warned its university community about the increase of reported cases of phishing campaigns and malware scams that are leveraging the current COVID-19 pandemic. In their statement, the McGill University urged their students to not open any hyperlinks or to reply to any emails, and to immediately delete these messages.

When scammers enter into communication with an individual, there is typically a request for money. For example, one of the ways that scammers receive money is by asking for a payment via Bitcoin. There was an instance where a scammer threatened to infect an individual and their family with coronavirus if they refused to pay a total sum of $4000 through Bitcoin. There have also been other cases where alleged charities ask for financial donations via Bitcoin.

The United States is also experiencing scams related to coronavirus. The United States Department of Justice released a report regarding cases where scammers were selling fake cures for COVID-19 online. There are other instances where hackers are locking personal devices and asking for money to unlock them.

Posing as members of reputable organisations

The World Health Organization (WHO) reported that scammers are using the current situation of COVID-19 to pose as WHO representatives to steal money and sensitive information, such as usernames and passwords, from individuals. Fraudsters are also sending phishing emails allegedly from WHO, asking individuals to download a malware document regarding safety measures and the spread of coronavirus.

Another international organisation that confirmed several COVID-19 scams was the International Criminal Police Organisation (INTERPOL). They confirmed that scammers are posing as a clinic or hospital official, calling individuals to let them know that one of their relatives has fallen sick with COVID-19 and that they require a payment to proceed with medical treatment.

Scammers have threatened to deport international students if they refuse to make a payment

In addition, the University of Ottawa (Canada) warned their students of telephone fraud cases where scammers are posing as government officials of the Canada Revenue Agency, Ottawa Police Service, or the Royal Canadian Mounted Police. Fraudsters are either making job offers or inquiring about personal information regarding the health or immigration status of students. Scammers have threatened to deport international students if they refuse to make a payment.

Consequently, students are not the only ones being targeted. The University of Waterloo in Canada reported the circulation of a phishing email addressed to parents and guardians. The scam email was sent by an alleged Public Health Agency of Canada official in concerns to the COVID-19, and asked them to click on a hyperlink to access a letter from the alleged “medical officer of health”.

Hong Kong is also experiencing coronavirus-themed scams. Scammers are posing as government officials and contacting individuals to let them know that there are some anomalies with their health. The scammer then proceeds to request personal banking information.

A similar case occurs in Singapore, where the government set up teams to conduct contact tracing – the process of identifying individuals that have had close contact with COVID-19 patients. Scammers have profited by posing as members of these contact-tracing teams to ask individuals for their financial details.

In the United States, fraudsters are luring individuals to pay to reserve a vaccine against coronavirus. Scammers are posing as members of the Centers for Disease Control and Prevention and asking individuals for their credit card information along with their social security number.

Protecting ourselves from COVID-19 scams

Thus, with all these different types of scams what can we do to protect our academic communities? The University of Ottawa in Canada posted an article specifically addressing how individuals can protect themselves from COVID-19 phishing emails. The following is a list of their recommendations and tips:

• Be wary of emails that convey a sense of urgency or request immediate action.
• Avoid replying to email requests for personal information, passwords or credentials.
• Stay away from unknown links or attachments.
• Review the sender’s full email address carefully. Delete emails from unknown, unsolicited or suspicious senders.
• Verify that hyperlinks are trusted links by hovering your mouse pointer over the image or link without clicking on it. Confirm that the website address is familiar before clicking; if it is unfamiliar, do not click on the link and delete the email. Clickable images or links are a favourite tactic in phishing attempts.
• Delete emails that include unexpected attachments, and remain alert! The use of email attachments to infect computers is a common approach for cyber-attacks.

In the case of telephone fraud, it is important to keep in mind that, while some institutions may contact you by telephone to request additional information regarding an application or a file, they typically do not call to collect money or payments.

The United States Federal Trade Commission (FTC) explained how scammers using robocalls are luring individuals to pay for COVID-19 treatments or work-at-home schemes. If you receive a suspicious call, FTC advises to:

• Hang up. Don’t press any numbers. The recording might say that pressing a number will let you speak to a live operator or remove you from their call list, but it might lead to more robocalls, instead.
• Before you pass on any messages, and certainly before you pay someone or share your personal information, do some fact-checking by contacting trusted sources.

Responding to online and telephone fraud

In instances of online scams, you can reach out to your institution’s information services and technology unit. They can provide you guidance on how to submit a security incident, request a security assessment, or report suspicious emails. They can also provide you with digital self-defence training and direct you to additional cybersecurity resources.

Your university's international office can also provide you with guidance regarding scams, as they are familiar with immigration processes and may be aware of scams happening around the world. If you receive a suspicious call (eg, an alleged immigration officer), the international office is a great resource to confirm their veracity.

It is important to report instances of fraud and scams to the appropriate authorities, as many cases go unreported. You can file a report with your local police, and you could also reach out to an organisation and make them aware of scammers that are impersonating them.

Protecting students and staff also includes keeping them and their data safe from scammers looking to take advantage of an already difficult situation. With the confusion created by the ongoing COVID-19 pandemic, it is essential that we keep ourselves informed on the added cybersecurity risks during these difficult times.