{"id":535,"date":"2025-04-25T17:40:15","date_gmt":"2025-04-25T21:40:15","guid":{"rendered":"https:\/\/www.montclair.edu\/phish-files\/?p=535"},"modified":"2026-02-16T11:59:40","modified_gmt":"2026-02-16T16:59:40","slug":"bank-mobile-fa-disbursement-phish","status":"publish","type":"post","link":"https:\/\/www.montclair.edu\/phish-files\/2025\/04\/25\/bank-mobile-fa-disbursement-phish\/","title":{"rendered":"BANK MOBILE\/FINANCIAL AID DISBURSEMENTS.docx"},"content":{"rendered":"<h2><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.montclair.edu\/phish-files\/wp-content\/uploads\/sites\/290\/2025\/04\/Clickup-965x1024.png\" alt=\"Screenshot from BankMobile phish. Clickup\" width=\"630\" height=\"669\" \/> <img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.montclair.edu\/phish-files\/wp-content\/uploads\/sites\/290\/2025\/04\/bankmobile-page-1022x1024.png\" alt=\"Screenshot from BankMobile phish. Microsoft\" width=\"680\" height=\"681\" \/><\/h2>\n<h2>Why this looks valid:<\/h2>\n<ul>\n<li>Email subject states it&#8217;s about financial aid disbursement<\/li>\n<li>Email attachment shows legitimate link used by Bank Mobile<\/li>\n<\/ul>\n<h2>Why this is phishing?<\/h2>\n<ul>\n<li>Email is blank besides an attachment<\/li>\n<li>The sender&#8217;s email address(es) is\/are external and not associated with Montclair<\/li>\n<li>When using the hover over method, you can see that the link within the attachment directs somewhere else<\/li>\n<li>Montclair\/Bloomfield will never request your NetID and password. This tactic is being used to gain access to your account(s)<\/li>\n<li>Spelling Errors: In some sending the attacker spells disbursement incorrectly<\/li>\n<li>Subject consistently changes but contains any of the following: Bank Mobile, Disbursement, Financial Aid Department or <span id=\"[object Map][1]\" class=\"HALYaf KKjvXb\" role=\"tabpanel\"><span class=\"pRdgxd\"><span class=\"DH3hqc\"><span class=\"pLVzkd\" title=\"Your $5,450.94 From ÌÇÐÄvlog Is Awaiting For You From Bankmobile\">Your $5,450.94 From ÌÇÐÄvlog Is Awaiting For You From Bankmobile<\/span><\/span><\/span><\/span><\/li>\n<li>Sense of Urgency: &#8220;strictly adhere to and resolve it within 24 hours&#8221;.<\/li>\n<\/ul>\n<h2>Additional Notes:<\/h2>\n<ul>\n<li>Do you think you&#8217;ve fallen for a scam? Did you share personal information? Downloaded malicious content? Please contact the IT Service Desk at <a href=\"tel:973-655-7971\">973-655-7971<\/a>\u00a0option 1 or email <a href=\"mailto:itservicedesk@montclair.edu\">itservicedesk@montclair.edu<\/a>.<\/li>\n<li>Please send any malicious emails you have received to <a href=\"mailto:phishfiles@montclair.edu\">phishfiles@montclair.edu<\/a> or by clicking the <a href=\"https:\/\/www.montclair.edu\/information-technology\/security\/pab\/\">Knowbe4 Phish Alert Button (PAB)<\/a>.<\/li>\n<li>Always use the &#8220;hover over&#8221; technique to check web links before clicking! For more security tips please visit our <a href=\"https:\/\/www.montclair.edu\/information-technology\/security\/security-tips\/\">Security Tips<\/a> page.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Why this looks valid: Email subject states it&#8217;s about financial aid disbursement Email attachment shows legitimate link used by Bank Mobile Why this is phishing? Email is blank besides an attachment The sender&#8217;s email address(es) is\/are external and not associated with Montclair When using the hover over method, you can see that the link within [&hellip;]<\/p>\n","protected":false},"author":349,"featured_media":536,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[2],"tags":[],"class_list":["post-535","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-fraud"],"_links":{"self":[{"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/posts\/535","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/users\/349"}],"replies":[{"embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/comments?post=535"}],"version-history":[{"count":5,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/posts\/535\/revisions"}],"predecessor-version":[{"id":540,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/posts\/535\/revisions\/540"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/media\/536"}],"wp:attachment":[{"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/media?parent=535"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/categories?post=535"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.montclair.edu\/phish-files\/wp-json\/wp\/v2\/tags?post=535"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}