Fake “UT Health” Job Offer Phishing Email
This email below has been confirmed as malicious or fraudulent by the Information Security department. If you have received this phishing email, do not open any attachments or follow the link(s) in the message; simply delete the email.The email below, subject-lined “UT San Antonio Development Office- Virtual Event,” was sent to over 294 students and offers a suspiciously appealing part-time job. While it appears to come from UT Health San Antonio Student Life, it exhibits several common phishing red flags. An analysis is provided below.
Red Flags:
- Fabricated sender department. “UT San Antonio Development Office” is not an actual department; there is no such office at the university. Scammers often invent plausible-sounding but nonexistent departments to lend false legitimacy to an email.
- Impersonated real name for false credibility: “Karl Miller-Lugo” is a real, publicly searchable individual at the university. Scammers frequently look up legitimate names online and attach them to fraudulent emails to make the message appear more trustworthy, without that person’s knowledge or involvement.
- Mass-sent to a large, broad audience: Being sent to 294+ recipients at once as a generic “reminder to all students” is inconsistent with a targeted job posting and is typical of mass phishing campaigns.
- Impersonal greeting: “Friendly reminder to all students” addresses no one specifically, unlike genuine outreach from an academic department or employer.
- Too-good-to-be-true job offer: Minimal hours (2-3 hrs/day), $600 weekly pay, tuition reimbursement, and a “comprehensive benefits package” for such a casual position is designed to make the offer irresistible and override critical thinking.
- Vague job description paired with overly specific pay details: The listing offers little real substance about the employer or role itself, yet emphasizes concrete financial incentives, a common tactic to grab attention without providing anything verifiable.
- Personal/free email address instead of an official one: Applicants are directed to send resumes and personal information to a Gmail address (“kidshappyheart@gmail.com”) rather than a verified university or institutional email address, despite the email claiming to be from a real named individual and UT Health San Antonio.
- Suspicious attachment: Recipients are told to “see attached for employment schedule”, a common method for delivering malicious links or malware.
- Mismatched sender identity and organization name: The email references both the fabricated “UT San Antonio Development Office” and “UT Health San Antonio Student Life,” have inconsistent naming.
What to do: Do not open the attachment or submit any personal information/resume. Click the “Report Phish” button in your email client to alert your IT/security team.
