Text scam impersonates ANR colleague

A text phishing (smishing) scam has been hitting ANR employees' phones. This scammer attempts to impersonate Greg Gibbs, ANR's Executive Director of Development Services. The texts originate from a 530 number and at first appear legitimate.

I am sharing Ethan Ireland's experience and thought process. Thank you, Ethan. 

Ethan received this text:

From (530) 646-XXXX

Hello Ethan, Let me know if you get
my text and if you are in office.
Greg Gibbs
Executive Director, Development Services
UCANR

Ethan told me, “I was initially taken off-guard and revealed some information I regret having revealed: I confirmed *who* I am, what my schedule is. However, I have gotten cold calls and texts from my colleagues who often have a (530) area code.

The first clue that made me suspicious is the syntax and grammar of the 'Ok sounds great' text, particularly the line '…you are to keep this confidential till the surprise will be done.' This put my back up, because I've gotten a lot of scam SMSes over the years, and they typically have mangled grammar and syntax. However, since there are some folks in the ANR team for whom English is a second language, I simply regarded this as a 'red flag' that would make me want to proceed with caution & get extra verification.

I thought I would keep them talking, and sure enough, their next message was asking me to get Apple gift cards, which I know is a common scammer tactic to get someone to get money to them in a way that is unrecoverable for the sender. I stated my concerns and brought up Greg Gibbs' page on the ANR directory. They responded with outrage — but I know emotional manipulation is a key part of social engineering, especially when impersonating someone higher up in hierarchy. By this point, I was about 95% sure it was a scam.

Ethan then tried to call Greg directly on his ANR phone and left a voicemail. Once he started pushing on verification, the scammer went silent.

This just one of manysmishing messages that went out recently. Great job to Ethan and many others who spotted this as a scam!

If you receive an unexpected text, verify its authenticity before providing information or taking action. If you receive a smishing messages purportedly from an ANR employee, report the message to ANR IT at help@ucanr.edu.

For more information on smishing and other social engineering methods, visit https://it.ucanr.edu/Security/Social_Engineering.

Jaki Hsieh Wojan
Chief Information Security Officer 

Read more