Re: How do you deal with "fake" student applications?

[Edward Murphy <emurphy () UWSA EDU>]

Hi Byron,

This phenomenon is fairly common in open access institutions. The motive that I’ve noticed is the .edu email address. 
Did you know you can buy a .edu email address on Ebay? The .edu email address is then used to get discounted, or free 
software and services. Many open institutions grant email addresses upon application, which is what the bad actor is 
seeking. Some schools have changed business processes to require an additional item as verification, before granting 
the email address. For instance, you must submit your transcript before an email address is provisioned.

- Ed

Edward P. Murphy, CISSP
Director
Office of Information Security
[cid:image001.png@01D45FDD.2C57CDF0]
780 Regent Street, Suite 305
Madison, WI 53715
emurphy () uwsa edu<mailto:emurphy () uwsa edu>
608.800.6701




From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> on behalf of "Tanner, Andrea" 
<atanner3 () CCBCMD EDU>
Reply-To: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU>
Date: Friday, February 15, 2019 at 3:30 PM
To: "SECURITY () LISTSERV EDUCAUSE EDU" <SECURITY () LISTSERV EDUCAUSE EDU>
Subject: Re: [SECURITY] How do you deal with "fake" student applications?


Hi Byron,



I am not a part of the security or enrollment management teams at CCBC but I have heard about this problem as well.  
From what I gather, the fake student applications are being put into the system because the “owners” are trying to 
harvest more accounts for phishing.



I wish I had an answer for what we are doing here to curb this.  I am sure more of this problem is coming down the 
pike.  I imagine that even if someone manually applied, paid the application fee and registered for courses, obtained 
an account, and started to phish people, they would more than make up the application fee they paid.  I recently 
applied for grad admissions at a school that had a free admission application special for a few weeks.   It took me 10 
minutes to apply. They needed transcripts before acceptance and I am not sure how easy it would be for someone to fake 
those?  I don’t get an email account until I register but I am not sure if I have to pay for the classes before the 
email account is issued…?



This new vector is something to think about it, isn’t it!   Especially those of us that have open admissions like 
Community Colleges.  Has anyone had an issue with admitting a fake person and actually gave them an email account that 
turned around and phished?



Happy Friday,

Andrea
Pronouns: She/Her/Hers

Andrea Tanner, M.S. | Senior Director, Technology Support | Community College of Baltimore County
Phone: 443-840-4155  | Catonsville Campus CLLB 104B       | atanner3 () ccbcmd edu<mailto:atanner3 () ccbcmd edu>
CCBC. The incredible value of education.




From: The EDUCAUSE Security Community Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Sosa, Byron

Sent: Friday, February 15, 2019 2:59 PM

To: SECURITY () LISTSERV EDUCAUSE EDU

Subject: [SECURITY] How do you deal with "fake" student applications?



CAUTION: This email originated from outside of CCBC. Do not click links or open attachments unless you recognize the 
sender and know the content is safe.



Good afternoon.  I have recently become a member of this forum and am impressed by the guidance that I have seen 
flowing back and forth.  First of all, thank you for sharing.  Second, I have also seen an increase in the number of 
“fake” student applications that are submitted /received at my institution and I was wondering if anyone else was 
having the same experience?  If you are, is there any guidance that you can please share with regards to how you deal 
with these in your environment?  Thank you in advance and have a good day.



Byron Sosa

Director of Information Security

Email:  mailto:bsosa () clcillinois edu



College of Lake County

19351 West Washington Street

Grayslake, Illinois 60030-1198