Subject: UHS Information Security Flash Alert: Gift Card/Wire Transfer Scam Messages

This is an official alert issued by UHS Information Security. To verify the validity of this message, you can visit the UH IT website at uh.edu/uit or contact UIT Security at 832-842-4695 or via email at security@uh.edu.

UH Staff and Faculty:

We are currently seeing UH users in all departments being inundated with waves of phishing messages designed to scam you out of money.

These messages are appearing to be sent by people in university leadership roles: Deans, Department Chairs, Division Heads, Managers, Supervisors, etc.   The scammers are doing their homework and using publically available organizational charts to determine the appropriate recipients of the message-people within the same department as the leader being impersonated. Next, the scammers try to mislead you into thinking that the sender’s address is a university address, when it is actually not. Typically, these addresses are in the format: <leader’s name/initials>.uh@gmail.com. NOTE: Look closely- even though UH is listed in the address – this is actually a gmail account.

The initial message usually asks if you are available and if you respond yes, you are provided with instructions to purchase a significant amount of gift cards and send pictures of the numbers to the scammers. We have also seen the scammers trying to trick staff into initiating wire transfers of university funds.

Your supervisors are likely NOT requesting you to immediately take actions such as to purchase gift cards or transfer university funds. These messages are designed to trick you into funding criminal activity.

Do not respond to the messages or spend any money (including personal funds) without going through all appropriate university processes. Verify any necessary transactions by phone calls or emails to official university numbers/addresses. Delete any fraudulent messages immediately.

If you have questions about the validity of any message you receive, contact UHS Information Security at security@uh.edu. If you responded to any of these messages with personal information or spent any money purchasing gift cards related to these scams, contact UHS Information Security or the UH Police.

Be a “Curious Cougar” – Be skeptical, ask questions and outsmart the scammers!

Mary E. Dickerson, MBA, CISSP, CISM, PMP

Assistant Vice-President | Assistant Vice-Chancellor, IT Security

Chief Information Security Officer

University of Houston | University of Houston System

A Carnegie-designated Tier One public research university

IT Security Phone: 832-842-4695

Email: mdickerson@uh.edu