January 12, 2006

Fraudulent e-mail sent to Purdue employees, students

WEST LAFAYETTE, Ind. - An e-mail sent to many Purdue employees and students that claimed to be from the Purdue Employees Federal Credit Union (PEFCU) and requested personal financial information is actually a fraudulent message, according to PEFCU and Purdue officials.

The e-mail comes with the subject header "Urgent Notification!!!" and is sent from the address "service@purdueefcu.com." The message claims that the recipient's account has been accessed by an unauthorized third party and requests that the recipient follow a link that goes to a fraudulent Web site. Both the e-mail and the Web site use the PEFCU logo.

Evelyn Royer, PEFCU vice president for risk management, confirms that the message is a fraud.

"No legitimate institution would ever ask for the type of information this message is asking for in an e-mail," she said. "Unfortunately, this is a common problem."

Royer says PEFCU has received reports of people following the instructions and giving the site their account information.

"If anyone does respond to the message, they should contact the credit union immediately, and we will issue them a new card," she said.

The message is a type of Internet scam known as "phishing," and the e-mails can be very deceiving, said Steve Tally, communications manager for Information Technology at Purdue (ITaP).

"This is the Internet equivalent of a counterfeit $100 bill," he said. "Someone who knows what to look for can spot the fraud, but to many people the message will look legitimate. We have seen phishing e-mails from most banks in the area, from credit card companies, from Internet sites such as eBay and PayPal, and even from Purdue University itself. Before complying with any suspicious message, computer users should first telephone the institution to find out if it is legitimate."

A warning message has been posted on the PEFCU Web site, and Royer said the fraudulent Web site had been taken down.

"We are in the process of stopping the phishing scam at this time," Royer said.

For more information and alerts about IT security, visit the SecurePurdue Web site.

Purdue News Service: (765) 494-2096; purduenews@purdue.edu

Related information:
PEFCU news release

To the News Service home page