Spear-phishing scam from “university personnel”

Spear-phishing is a targeted form of phishing in which fraudulent emails are sent to specific individuals at an institution, like the university, in an effort to gain access to confidential information.

This morning we are starting to see the spear-phishing scam emails being sent out in the name of known individuals at the university – in Tygerberg’s case – the Dean, Prof Jimmy Volmink.

Below is a mail that is being sent out “in the name” of Prof Volmink, entitled “Invoice Problem”. (click on image to enlarge) It was sent to several university addresses, uses a forged e-mail address from another university, and has been designed to convince people that it is legitimate.

This is a dangerous phishing scam because it seems to come from a known person.Do not respond to it and if you do receive it here is what to do:

Send the spam/phishing mail to the following addresses and

 Attach the phishing or suspicious mail on to the message if possible. There is a good tutorial on how to do this at the following link (which is safe):

  1. Start up a new mail addressed to (CC:
  2. Use the Title “SPAM” (without quotes) in the Subject.
  3. With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the mail as an enclosure and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.
  4. Send the mail.


If you did click on the link of this phishing spam and unwittingly give the scammers your username, e-mail address and password you should immediately go to and change the passwords on ALL your university accounts (making sure the new password is completely different, and is a strong password that will not be easily guessed.) as well as changing the passwords on your social media and private e-mail accounts (especially if you use the same passwords for these accounts.)

IT has set up a website page with useful information on how to report and combat phishing and spam. The address is:

As you can see the address has a at the end of the domain name, so it is legitimate. I suggest bookmarking this.

[ARTICLE BY David Wiles]


Comments are closed.


© 2013-2018 Disclaimer: The views and opinions expressed in this page are strictly those of the page author(s) and content contributor(s). The contents of this page have not been reviewed or approved by Stellenbosch University.