Proofpoint documented a fraud chain connecting compromised university email accounts, fake employment offers and demands for gift-card codes in research published September 28, 2026. Its researchers engaged directly with suspected fraudsters, providing evidence of the instructions used to turn an apparent job advance into a payment demand. [1]

An observed proposal shows how the payment pressure works

One published email proposes that the target keep $200 and have the remaining $300 disbursed or returned. Both amounts appear explicitly in the captured message. The proposal frames sending money as compliance with an existing obligation while leaving the target an apparent reward; the screenshot does not establish that either payment occurred. [1]

The data behind the story

A payment split proposed in one captured scam email

Amounts explicitly requested in the message reproduced as Figure 13 of Proofpoint’s September 28, 2026 research.

$
Source
Proofpoint university job-scam research, Figure 13

One observed adversary proposal, not completed transfers, victim losses or a representative average. The message does not specify the payment method for this particular split. Its amounts must not be presented as gift-card denominations or combined with the report’s separate approximate cheque average.

Show data tableHide data table
Scroll left or right to see all columns
A payment split proposed in one captured scam email ($)
CategoryAmount proposed in that message
Target told to retain200 $
Sender sought to have disbursed or returned300 $

This example is distinct from the report’s broader account of scanned cheques averaging about $1,000. Across the engagements it describes, supposed employers instructed targets to make a mobile deposit, retain roughly half as wages and buy gift cards in $100 increments with the rest. Proofpoint interprets the smaller card amounts as an attempt to avoid some retailers’ antifraud measures, without measuring a universal threshold or success rate. [1]

The initial credibility came from institutional email. Researchers describe forms posing as account-verification requests, followed by employment messages sent from compromised university accounts. The forms collected credentials and other personal information. The report says the observed account-takeover method depended on the absence of second-factor authentication; it does not establish that every university account was vulnerable. [1]

When targets resisted, the researchers observed repeated calls and messages, requests for alternative payment channels and threats, including impersonation of an FBI agent. The company linked its engagements to Nigerian infrastructure through tracking-link observations, while acknowledging that infrastructure can be disguised. That attribution describes the researched activity, not the identity of every person operating a similar scam. [1]

The study supplies no count of completed gift-card purchases, redeemed codes, identified issuer brands or total victim losses. It also does not give the engagement sample size or fieldwork dates needed to generalise the payment split. The documented risk is the conversion of a claimed employment obligation into a demand for transferable value; September marks its research disclosure, rather than the first appearance of the fraud model. [1]