EL PASO, Texas (KTSM) — At least a dozen students from UTEP have been scrambling for answers after learning that the thousands of dollars in financial aid refund money they were set to receive earlier this month was sent to an unknown bank account.
“It took about five days to get a response, and then ultimately I was told that there was nothing that could be done by UTEP. The money was stolen. I was a victim of a phishing incident and that I needed to contact the FBI,” said Cristian Corbett, a student at UTEP, who said he had noticed unfamiliar bank account information in his student account days before his refund was sent out.
Corbett said that he reported it to UTEP officials and was told to change his log-in credentials. Several days later, he was informed that the money had been stolen.
“The next day, I inquired with Student Business Services again about my refund, and that’s when I was told that my account was compromised and I was sent an email with a list of things to do like contacting the Department of Education, and to file an Internet crime report with the FBI. And I still haven’t received any word on if I’m going to receive my refund at all,” said Lorena Lopez, a student at UTEP.
Lopez said she contacted UTEP financial aid on Jan. 21, when she realized she had not yet received her refund and that she could not recognize the bank account information on her student account.
A few days later, she learned that her account had been compromised.
These are just two of over a dozen students KTSM has been in communication with who said their financial aid refund was deposited into an unknown account.
The situation from student to student varies slightly, but most students noticed that their student account had unrecognizable bank account information, to which their refund was deposited to.
The students expressed frustration and helplessness, saying that UTEP staff told them there wasn’t much they could do and that they had to file a report with the FBI and contact the U.S. Department of Education.
In a statement to KTSM, the University of Texas at El Paso (UTEP) said that it became aware of a number of students that were targeted in a phishing attack, and that after conducting an “extensive analysis” they were able to determine that the university’s systems were not hacked.
UTEP officials said that they’re working proactively trying to reach students affected to offer them one-on-one help.
They offered the following statement:
“A phishing attack is, sadly, a very common form of cybercrime. While UTEP was proactive in identifying other students who may have been affected, we don’t believe this tactic is specifically focused on UTEP.
“UTEP has been in contact with law enforcement and is encouraging students who are victims to file a report with the FBI’s cybercrimes unit.
“Like many employers and schools, UTEP provides cybercrime prevention training to students and staff. These criminals are getting more and more sophisticated and everyone in the community needs to be cautious about clicking on links or responding to emails that don’t seem quite right.
UTEP is working to help students who were victims of these attacks.”
UTEP officials said that they are working with the FBI on an ongoing investigation into the matter, and while they cannot confirm that all students were victims of a phishing attack, they provided one of their cyber security experts to explain the difference between a phishing attack and hacking.
“We need to understand that phishing is a social engineering attack, which means attackers are trying to play with human psychology, so they try to persuade humans in order to share their sensitive information,” said Palvi Aggarwal, an assistant professor in the Computer Science Department at UTEP.
Aggarwal said receiving phishing emails is very rare, therefore hard to spot. She also said attackers have become quite sophisticated at making their emails appear legitimate.
“When they’re sending you an email, (they will use) a domain name that is very familiar to you,” Aggarwal said. “For example, (if they use) Yahoo!, rather than using double Os, they will use two zeros.”
Most students, however, said they’re confident they only opened emails from their professors or counselors and don’t recall how they could have become victims of this attack.
None recall ever sharing their log-in credentials with anyone either.
“I don’t think it was phishing. Honestly, I don’t even check my emails. I only use it to contact my professors and advisers. I never clicked on an (email). I don’t agree with the guidance that UTEP is giving us,” said Juan Ruvalcaba, a student at UTEP.
Lopez, who had contacted Student Financial Aid to report the unrecognizable information in her student account, said she was told by UTEP’s security team that she had not been a victim of phishing.
“They went through my outlook, my email account, and they said that I, in fact, did not click on any phishing scams and that there were no suspicious log-ins to my UTEP account either but they had me change my credentials,” Lopez said.
Meanwhile, Aggarwal warns that anyone could fall victim to phishing and urges students to be vigilant for signals like the domain names that may help them spot a phishing email.
“You have to train yourself in order to identify those emails. So look for the cues that I mentioned earlier and that’s super important because one of the keys, according to research, is overconfidence is one of the reasons why people are susceptible to phishing emails, thinking that I cannot be phished,” Aggarwal said.
For students who are experiencing financial hardship as a result of the incidents involving their financial aid refund, UTEP is encouraging students to apply for free financial assistance through the Emergency Fund in the Division of Student Affairs, by clicking here.
For questions about emergency funds, students can contact MinerSupport@utep.edu.
Read: Read More