Since the year 2022, the College of Lake County has seen an upsurge of scam emails directed at not only students but also staff and faculty, Cybersecurity Director Byron Sosa said.

Sosa has been working at the CLC for over five years as a facilitator trying to make sure that the college’s security system runs smoothly.

“My role is to identify all the different things that could cause the college risk,” Sosa said. “Whether it’s student data, staff data, faculty data, and systems like laptops, workstations, servers, anything and everything that’s connected to the college’s network.”

Sosa said he and his team evaluate anything suspicious and make sure that the right steps are taken to secure the colleges’ data. When something needs to be addressed, they make recommendations to the board of trustees to prevent threat actors from gaining sensitive information. If it gets approved, they implement it; if it doesn’t, they table it, at least for the moment.

Threat actors are individuals or groups that exploit vulnerabilities within a system. These vulnerabilities aren’t just system-based – they’re user-based.

Scam emails are sent by these threat actors to get recipients to give up their information without knowing. Most emails trick the recipients into believing there’s a problem with their account, telling them that they need to login and verify that it’s still in use. They then use the information they have gained to take advantage of them.

Sosa said there is a type of malware called keystroke logger that could be downloaded into a device and made to record what’s being typed. If a student tries to make a purchase or log into an account that holds personal information, they would be able to access it through what they’ve typed.  

“The moment you log in, the bad guys now have your username and password,” Sosa said. “Without you knowing, they’re gonna log into your account and probably start looking around, seeing who you’ve been emailing, what kind of information you got.”

Multiple people at the college each year fall victim to scam emails and have their information used to expand a threat actor’s network. Compromised emails are used to trick other students they communicate with into giving up their personal data. If you know the person who sent out the email, it is more likely you will trust it, and they know that.

“You have to be vigilant with what you receive and what you click on,” Sosa said. “You have to really make sure that if you do get something, you almost need to be 99.9% sure that it’s coming from me before you click on it.”

Other scam emails offer enticing opportunities like job offers or scholarships that promise to pay for their college tuition. Some have even been reported to be disguised as Honors programs trying to recruit students to apply before a deadline.

Sosa gave an example of a particular job scam campaign that has convinced people to take the conversations offline and into phone calls or text messages. Once the threat actor moves the person offline, they record their information and convince people to give them money or somehow gain access to their bank account.

“We’ve seen students lose money,” Sosa said. “Because they’ll have these conversations [offline] and send money to these threat actors. By the time they realize that it’s a scam, some have lost some funds”

If a person’s bank account or Social Security number has been compromised, Sosa urges them to reach out to all three credit bureaus – Equifax, Experian and TransUnion – to request the accounts be frozen. This way, if anyone tries to purchase something with your information, they would be denied from making it.

Scam emails come in waves and at different times of the year. Sometimes they’re themed around holidays or events. Typically, they surge at the start of the fall semester, when new students coming out of high school receive their email accounts.

“Some of these students never had any cybersecurity training,” Sosa said. “When they get here, they’re prime candidates for somebody to send them a phishing email.”

When it comes to the internet, one thing is certain: Once your information is out there, it’s out there. When your information is shared on the internet, there is no way to remove all traces of it. If a person falls victim to a scam email, the best thing to do is to notify the cybersecurity department of the incident. They then typically recommend that students use another device to change the passwords of all their accounts to ensure threat actors can’t get hold of any other accounts.

“If something doesn’t feel right, say something and report it before you do anything,” Sosa said. “You’re never going to get in trouble with me for telling me you clicked on something bad. I would rather know about it five minutes after you did it than five weeks later, when a lot of things could have happened between then, that I wouldn’t know how to react to.”

Sosa said educating students about how to identify scam emails and teaching them what to do after is what’s going to be most important. He said no matter how many times you change a password or email address, if a person doesn’t understand what to look for, nothing is going to change. All it takes is one click for a threat actor to feel encouraged to send another.

When students are confronted with a possible scam email, they can click on a red hook found on to the right of the Gmail screen. This reports the email to Sosa’s team to be evaluated.

Sosa and his team have been working on trying to educate students as much as they can. For one of their events in last year’s cybersecurity month, the department held a tabling event that tested whether students could identify a scam email. Sosa said approximately three in five of all students tested fell for scam emails. Throughout the tabling event his team counseled students and helped them understand what to do next time.

The Cybersecurity department also offers presentations to clubs, organizations, or anyone that wants to learn about how to protect themselves. The department has  recorded presentations that are available through CLC Learn. The presentations offer lessons on social media safety, how to make secure passwords, and where to go if they believe an account has been compromised. However, no matter their efforts, they’ve found it rare for students to participate.

“We’re trying to incentivize the students to take the cybersecurity training, as it will help them at school, at work, and in their personal lives to reduce the risk of them being tricked by these threat actors,” Sosa said.

On March 24 CLC will be implementing Multi-Factor Authentication (MFA) to help prevent threat actors from accessing CLC accounts. The authentication method would request that you use your phone or another email address to verify who is accessing the email, a method that’s already used with staff and faculty accounts.

Along with a letter to students, the cybersecurity department has provided a video guide and instructions on how students can set up MFA. They have also included instructions on how to report phishing emails that someone might encounter. If students would like to reach the cybersecurity department, they can email [email protected].