The most common scam among APA divisions is an email that looks like it’s coming from the division president or another officer and asks the recipient to help with a payment or purchase. An example is a request to purchase gift cards. If the recipient purchases the cards and responds, the scammer asks to be sent the codes from the cards. Once that is done, the scammer has been successful in stealing the money value of the cards.
Scammers may also request payments through peer-to-peer payment apps like Zelle, Venmo, or Cash App, claiming these are more convenient or faster than traditional payment methods. Unlike credit card purchases or bank transfers, peer-to-peer payments are treated as authorized transactions between known parties with little fraud protection, leaving victims with little recourse for recovery.
This is a type of phishing, or the fraudulent practice of sending emails purporting to be from reputable companies or known individuals in order to induce others to reveal personal information, such as passwords and credit card numbers.
Scammers have been web scraping names, positions and email addresses via automated systems or human copy-and-paste from division websites, both APA-hosted and non-APA-hosted, and using that information to create these scams. This has also been happening with other organizations that list names and email addresses on their websites.
Consider limiting publicly available contact information on division websites. While the goal is maintaining member accessibility, displaying individual officer email addresses may create unnecessary risk by providing scammers with ready-made impersonation targets. More secure alternatives include:
- Using a main division email address that forwards to appropriate officers based on inquiry type
- Implementing contact forms instead of displaying direct email links
- Listing only role-based contact information (e.g., "For membership questions, email membership@division99.org") rather than personal addresses
- This approach maintains member access while significantly reducing the information available to scammers who web scrape division websites for officer names and email addresses.
Divisions may want to consider the following non-exhaustive list of additional procedures for financial requests:
- Communication Verification Protocols (e.g., email to all officers from known addresses to confirm the request is valid)
- Require dual verification for any request involving money, payments, or purchases - both email confirmation from a known address AND phone verification
- Use predetermined verification questions or code phrases that officers can reference in legitimate urgent requests
- Create a 24-hour waiting period for unusual financial requests, even when they appear to come from known officers
We offer these tips and more we have gathered that can be helpful in combating these scams. We suggest that each division review them and consider what works best for them:
Be alert
- Be cautious when you get urgent messages asking for a check or some type of payment to be done as quickly as possible, especially during a hectic time or when officers change, such as end of the year and conference time.
- Hover over the “from” name in an email or click to reply and you may see an unfamiliar or questionable address. It can look like the real thing too.
- Call the person or email them separately at a known email address to confirm the request.
Prevent
- Spread the word to caution others about these scams, especially to those who are listed on your division website. Find some sample wording on our "Advising division members to beware of email scams" page.
- Set up a division-wide policy such as no one complies with a request involving funds unless a phone call or a message to a known email confirms it, then spread the word.
- Consider setting up a generic email address for each officer, such as divxxpresident@gmail.com, and use those emails on the website rather than individuals’ own email addresses. APA does not provide such email addresses; divisions may set them up through Gmail and other providers.
Report
- File a complaint with the FBI Internet Crime Complaint Center (IC3)opens in new window to help shut down cybercriminals.
- Report scams to your division engagement liaison.
- Report suspicious emails to your own email providers. That can better help Gmail and Yahoo and university and business IT services better detect and prevent phishing emails from getting through.
- If you got a phishing email or text message, report it. The information you give can help fight the scammers.
Step 1. If you got a phishing email, forward it to the FTC and to the Anti-Phishing Working Group. If you got a phishing text message, forward it to SPAM (7726).
Step 2. Report the phishing attack to the FTCopens in new window.