How it works:

One of the most successful phishing scams involves a boss, minister, coworker, or friend asking you to go out & buy gift cards. It uses clever social engineering, not advanced technology. Here's how you can spot & avoid the "gift card" scam.

Ask yourself: if your boss/minister/friend wanted to give out gift cards, how would they order those gift cards? Would they send you an email asking you to rush out and buy some, and then ask you to scratch off the backs and email the codes?

Probably not. Yet this exact scenario has become a prolific, and unusually successful, email phishing scam.

The scam goes like this: 

You receive a ‘plain text’ email. The email appears to come from someone they are familiar with.
In the email, the sender asks you to buy some gift cards.  Note: sometimes they try to get your attention first - with things like "I need urgent help with something today" or "Can you do something for me" or something similar.  If you reply, it leads to asking for help in buying gift cards.

Once you tell them you've bought the gift cards, the email asks you to scratch off the gift card backings to display the unique PIN codes and email those codes back to them.

The scammer takes the code, cashes out the gift card in minutes, and vanishes.

This scam has made the rounds since mid-2018. That cybercriminals still use it means it still works. They have ramped up the scam in the time of Covid-19 - counting on our goodwill for each other to help them succeed!

Several of our members have reported receiving such emails—unfortunately, some falling for them—within the last few months.

As scams go, this one's clever. How does it work so well?

1. It uses a "display-name spoof" – putting a real person's name in the "From" field. (Often either the name or subject is in all CAPS - which is a clue to look for!)
2. The text of the email reads like the person actually wrote it. We can spot terrible grammar a mile away. Normal grammar, however, that doesn't ring alarm bells.
3. We are a loving congregation —so when we’re given a mission, we are eager to help!
4. Sometimes the scam uses a time limit, e.g. "Can you do this before end of day?" This creates a sense of urgency, which compels action with little time to think.

Defeating the scam is simple.

1. First, hit Reply to the email and check the return email address for the "request." Chances are it's not your boss/minister/coworker or friend's email address. Delete that email (do NOT send it).
2. Next, send a separate email to that person asking if they sent the first message. Chances are they didn't. (Or call them, or call us at 925-934-3135 Ext 0)

That's all. One email (or call) and one check, and you avoid a scam that could cost hundreds or thousands of dollars!

We do not know if responding compromises your account in any way - so it's best to not engage with the senders at all if possible. If you are not sure, follow step 2 above and you will never need to worry!

No one from MDUUC will EVER ask you to buy gift cards or send money directly via email. We only encourage donations sent directly to the church office, or via our mduuc.org/give page. We encourage you to double-check with us if you are unsure of a request.

More questions? Contact info@mduuc.org