Student Job Scam Uses School Email + Google Forms

How the attack worked

A student employment phishing campaign used compromised school email accounts to distribute job offer lures to students. Because the messages originated from real, compromised accounts, they passed common email authentication checks that many people rely on as a signal of legitimacy. The lure directed recipients to a Google Form, which then collected banking information, residential addresses, and other personal details. Researchers observed at least 3,200 messages tied to this campaign, and the data collected is consistent with money mule recruitment and account compromise preparation.

Why it succeeded

This campaign combined two trust signals that people rarely question: a familiar school email address and a widely used tool, Google Forms. Recipients had little reason to suspect the message wasn't legitimate since it came from a real school account and passed authentication checks. Using Google Forms instead of a spoofed login page also lowered suspicion, since the form itself carries no obvious phishing indicators like a fake domain or broken branding. The pretext, an on-campus or student job opportunity, is plausible and appealing, especially to students actively looking for work.

What to watch for

• Unsolicited job offers that ask for banking details before any formal hiring process
• Application or onboarding forms hosted on Google Forms rather than an official school hiring portal
• Pressure to submit personal or financial information quickly to "proceed" with an opportunity
• Requests for residential addresses or banking information paired with vague or generic job descriptions

Building resistance

Students, faculty, and staff should treat unsolicited job offers, particularly ones requesting banking details upfront, as suspicious until verified through official school hiring channels. A message coming from a legitimate school address, or one that passes authentication checks, is not proof that the request itself is legitimate. Anyone asked to submit sensitive data through a Google Form should confirm who owns the form and why it's being used before entering any information. Student services and financial aid offices can reinforce this by publishing clear guidance on official hiring processes and reminding students that legitimate employment offers rarely require banking details as a first step.

How did the student job scam bypass email security?

The campaign used compromised school email accounts, so messages passed common email authentication checks and appeared legitimate to recipients.

What information did the scam try to collect?

It attempted to collect banking information, residential addresses, and other personal details, consistent with money mule recruitment or account compromise.

Why was Google Forms used in this attack?

Google Forms served as the collection mechanism for victim data, making the scam appear less suspicious than a fake login page while still gathering sensitive details.

How many messages were part of this campaign?

Researchers observed at least 3,200 messages sent as part of the campaign.