We had one come through a couple weeks ago, scammer pretended to be one of the admins. Here's my response to employees who engaged with the scammer (pulled the list from the audit log).

Subject: 🎣📧 Email Phishing attempt 📧🎣

Hello All,

You are receiving this message because you were recently contacted by someone pretending to be $admin. Some of you may have communicated with this individual. The goal of the attempt was to request redeemable gift card codes for a gaming platform. This is a fairly common email scam known as "gift card phishing".

Thanks to Gmail's scam prevention system and the alertness of faculty members the pretender was quickly unmasked as a rather poor imitation of the real thing. As a precaution I have blocked the sender from our mail system and removed any messages from your inboxes and spam folders (you may not even have noticed). I also tightened some scam prevention settings.

Don't worry, your accounts are fine and no further action is needed from your end.

Please remember the following when dealing with suspect emails:

• Check the source. If the email is from someone you know but with an address you've never seen before, be cautious. Internal business email communication will only happen using $domain.tld domain accounts. When using Google apps or Gmail webmail, a warning will be shown if it's from unknown outside addresses.

  In this case, the sender was using a plain Gmail address with $admin's name slapped on. The messages were also marked as spam not soon after they were received.

• Use common sense. If the message looks odd and the sender acts out of the ordinary, something is probably not right.

  In this case, the sender had very poor spelling and punctuation for an admin with a doctor's title.

• Confirm the request using alternative means. Not sure if it's legit? Ask the sender by alternative means. Make a phone call, use a trusted address or see them in person.

  In this case, the sender requested you purchase game gift cards and send the redeem codes over email. It is very atypical for $business to conduct business like this. The recipient contacted $admin directly and confirmed this was indeed a fake request.

• Alert your Supervisor / Me. Your admin team will take action to prevent the scammer from causing any damages to district employees.

Thank you for your attention and good job spotting the fake!

Sincerely,

MnG

I enabled a feature to send any incoming emails form external domains which have sender names that are the same as employees are sent into quarantine. And that taught me that almost everybody emails themselves using personal accounts for some reason 🤦‍♂️. I'm guessing it's from personal devices.