Re: Fake Direct Deposit Forms

["Manjak, Martin" <mmanjak () ALBANY EDU>]

Ron,

You're not. We had an incident last week where an account was compromised and used to send the DD change request to our 
HR department. The fake check and form also referenced an American Express National Bank account. In our case, the A/C# 
was 6220124014299.

It was flagged because our form requires state assigned employee IDs, not SSN.


The emails were sourced from QuadraNet, Inc colocation centers in Atlanta, LA, and Huntsville.



The mystery we haven't solved yet is how the employee's email was compromised. No spam was sent, just the DD change 
request. They did set up an In box rule that marked any responses from HR as read and moved to the Delete folder to 
prevent the victim from being tipped off.

Marty Manjak
CISO
University at Albany

From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> On Behalf Of King, Ronald A.
Sent: Tuesday, September 10, 2019 11:14 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Fake Direct Deposit Forms

As an FYI, I have had three reports of fake Direct Deposit requests. Two of them included completed forms. The forms 
included the victims correct address and social. Both would have redirected full paychecks to American Express National 
Bank in Salt Lake City. Attached is an image of the electronic check. Given the size of the Equifax breach and the loss 
of the pertinent info, we cannot be the only institution seeing this.

Ron

Ronald King
Chief Information Security Officer

Office of Information Technology
(757) 823-2916 (Office)
raking () nsu edu<mailto:raking () nsu edu>
www.nsu.edu<http://www.nsu.edu/>
@NSUCISO (Twitter)
[NSU_logo_horiz_tag_4c - Smaller]


**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community