With the return to campus this fall, the University of Utah Public Safety Department (UUPD) is reminding campus community members to be aware of the risks of cybercrime and fraud.
College students are prime targets for hackers and financial crime because they often share private information on social media, use apps and social media platforms to communicate, have interconnected devices and often have good credit or no credit. College campuses are also at a crossroads for thousands—including faculty, students, patients and visitors—including citizens from other countries, refugees and immigrants.
From the first day of classes, Aug. 21, 2023, to this month, UUPD has tracked 40 cases of cybercrime.
Scammers use threats or fear to obtain money or personal information from a victim. Cases from the U included both threats of violence to the victim, their friends and family members or threats of exposures. Scammers used email, phone and text messages to contact the victims and often had personal knowledge about the victim or their family or used images of violence to frighten the victim.
A specific type of extortion scheme that involves threatening to share intimate photos or written messages unless someone complies with the scammers’ demands.
University victims were most often in contact with offenders through Instagram, email or chat apps and websites. Scammers frequently threatened victims with exposure to their friends, family members or school officials which prompted victims to pay the scammers to avoid embarrassment or sanctions from the university. The scammers asked their victims to send money through encrypted cash transfer apps, making it difficult or impossible for them to recover the money.
Often, after victims comply with the initial demands, they are repeatedly contacted for more and more money. In one case, a victim lost over $80,000 to scammers before contacting police.
Scammers advertise free tickets or tickets for sale to events and concerts and then disappear with the victims’ money after the transfer.
University victims were most often in contact with the scammers after answering ads on GroupMe, Facebook Marketplace or text accounts.
Scammers asked for money for the tickets in the form of encrypted cash transfer apps, making it difficult or impossible to recover the money. In most of the cases, the scammers asked the victim for “proof” of their legitimacy by sending an image of themselves holding a picture ID. Scammers then used those images to pose as legitimate sellers to other unsuspecting victims.
Scammers contact victims pretending to be a government authority, such as police or a representative of the court, or a person known to the victim, such as their boss.
Victims are told they must pay money to avoid being arrested or deported. Alternately, scammers posing as a boss may ask a victim to urgently help them by sending money or purchasing gift cards and sending the money.
U victims were threatened with arrest and student visa revocation. In at least one case, the victims were parents of students who were told they had to pay money to avoid their child being arrested.
The scammers in all cases had personal details that led the victims to believe they were legitimate. Most cases involved phone numbers spoofed to look like actual police numbers or email addresses closely resembling a legitimate university account.
Scammers make contact with the promise of a well-paying job and then trick victims into sharing personal information or cashing fraudulent checks for them.
Victims were most often contacted by scammers through email or GroupMe Chats. The return emails of the scammers were spoofed to look like university departments.
In some cases, the victims were asked to provide all of their personal details and bank information to set up a payroll account. In some cases, victims were overpaid and asked to send the overpayment back through encrypted cash transfer apps—days later their own bank reported the funds were fraudulent.
This is a type of “get rich quick” scheme that involves scammers offering victims a variety of quick-return investment opportunities.
Scammers pay a quick return on the victims’ initial investment to gain their trust and entice them to make larger investments. The scam is often perpetrated using cryptocurrency, making it nearly impossible to recover the lost funds. Victims at the University of Utah lost large amounts to this scam.
One other scenario involves deep fakes, or putting a photo of a person’s head on a compromising or embarrassing photo. Chief Safety Officer Keith Squires said he has talked with international students at the U who have been targeted by such extortion schemes.
In these cases, scammers pretend to be someone representing the university who requests a photo from a potential victim. Once they receive the photo, the perpetrator adds it to pornographic or other obscene images before threatening to distribute the photo if the victim does not come up with cash.
University Police have shared those cases with partners at the FBI and the Utah State Bureau of Investigation. A year ago, the FBI issued a warning about increasing incidents of this tech-assisted crime.
“Working together, we have more opportunities to prevent cyber-related crimes, help those who have been victimized find resources and more aggressively pursue those committing these very harmful crimes,” Squires added.
University Public Safety officials believe many victims on campus are under-reporting cases of cybercrimes due to fear or embarrassment.
“Every member of our campus community should feel confident that University Police will do everything in our power to work to investigate these crimes and support the victims,” said Brian Lohrke, UUPD captain.
Public Safety is partnering with the Statewide Information & Analysis Center (SIAC) to gather information and identify the scammers.
“Our goal is to try to identify the perpetrators and help victims recover from these experiences,” said Jeffrey Plank, sergeant with the Utah Department of Public Safety. “We may not be able to recover the money that has been lost, but we hope to be able to prevent this from happening to someone else in the future.”
UUPD offers some tips for avoiding cyber scams:
- Never send a person a copy of your identification to a person you don’t know.
- Be wary of transactions that request payment in the form of gift cards or through encrypted cash transfers. Use established banking apps or cashier’s checks.
- Be wary of sellers who are reluctant to meet in person or let you confirm the product for sale.
- If you have questions or think you are being scammed, contact University of Utah Police Dispatch at 801-585-2677 to report the incident.
Finally, Public Safety leaders note that the university will never punish a member of the campus community for asking for help or reporting a crime.