Canonical URL: https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/ --- description: Researchers engaging fraudsters observed fake-check advances followed by requests to buy USD100 gift cards and send back the codes. title: Proofpoint links university job scams to small-denomination gift-card demands image: https://giftcard.news/images/social/v1/proofpoint-links-university-job-scams-small-denomination-gift-card-demands-7ec18eb2c0ea48fb06e8864c13a61e96.jpg --- 1. [Home](https://giftcard.news/) 2. [Fraud & Security](https://giftcard.news/fraud-security/) # Proofpoint links university job scams to small-denomination gift-card demands Researchers engaging fraudsters observed fake-check advances followed by requests to buy USD100 gift cards and send back the codes. By [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) September 28, 2026 3 min read [ Google News ](https://google.com/preferences/source?q=giftcard.news&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) Share [ ](https://x.com/intent/post?url=https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fproofpoint-university-job-scam-gift-card-cashout-research%2F%3Futm%5Fsource%3Dx%26utm%5Fmedium%3Dsocial&text=Proofpoint+links+university+job+scams+to+small-denomination+gift-card+demands&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "X") [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fproofpoint-university-job-scam-gift-card-cashout-research%2F%3Futm%5Fsource%3Dlinkedin%26utm%5Fmedium%3Dsocial&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "LinkedIn") [ ](https://wa.me/?text=Proofpoint+links+university+job+scams+to+small-denomination+gift-card+demands+https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fproofpoint-university-job-scam-gift-card-cashout-research%2F%3Futm%5Fsource%3Dwhatsapp%26utm%5Fmedium%3Dsocial&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "WhatsApp") ![Customer hands holding a blue card at a retail payment terminal](https://giftcard.news/images/variants/v1/proofpoint-links-university-job-scams-small-denomination-gift-card-demands-customer-hands-w1280.webp) Illustrative retail checkout photograph. It does not depict a participant in Proofpoint’s research or a gift-card purchase associated with the reported scams. Photo: SpotOn / Unsplash [Proofpoint](https://giftcard.news/company/proofpoint/) documented a fraud chain connecting compromised university email accounts, fake employment offers and demands for gift-card codes in research published September 28, 2026\. Its researchers engaged directly with suspected fraudsters, providing evidence of the instructions used to turn an apparent job advance into a payment demand. [\[1\]](https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#article-source-1) ## An observed proposal shows how the payment pressure works One published email proposes that the target keep $200 and have the remaining $300 disbursed or returned. Both amounts appear explicitly in the captured message. The proposal frames sending money as compliance with an existing obligation while leaving the target an apparent reward; the screenshot does not establish that either payment occurred. [\[1\]](https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#article-source-1) The data behind the story ### A payment split proposed in one captured scam email Amounts explicitly requested in the message reproduced as Figure 13 of Proofpoint’s September 28, 2026 research. Amount proposed in that message $ Tap or hover for details. All values are also available in the data table. Source Proofpoint university job-scam research, Figure 13 One observed adversary proposal, not completed transfers, victim losses or a representative average. The message does not specify the payment method for this particular split. Its amounts must not be presented as gift-card denominations or combined with the report’s separate approximate cheque average. Show data tableHide data table Scroll left or right to see all columns __A payment split proposed in one captured scam email ($)__ | Category | Amount proposed in that message | | ------------------------------------------- | ------------------------------- | | Target told to retain | 200 $ | | Sender sought to have disbursed or returned | 300 $ | This example is distinct from the report’s broader account of scanned cheques averaging about $1,000\. Across the engagements it describes, supposed employers instructed targets to make a mobile deposit, retain roughly half as wages and buy gift cards in $100 increments with the rest. Proofpoint interprets the smaller card amounts as an attempt to avoid some retailers’ antifraud measures, without measuring a universal threshold or success rate. [\[1\]](https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#article-source-1) The initial credibility came from institutional email. Researchers describe forms posing as account-verification requests, followed by employment messages sent from compromised university accounts. The forms collected credentials and other personal information. The report says the observed account-takeover method depended on the absence of second-factor authentication; it does not establish that every university account was vulnerable. [\[1\]](https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#article-source-1) When targets resisted, the researchers observed repeated calls and messages, requests for alternative payment channels and threats, including impersonation of an FBI agent. The company linked its engagements to Nigerian infrastructure through tracking-link observations, while acknowledging that infrastructure can be disguised. That attribution describes the researched activity, not the identity of every person operating a similar scam. [\[1\]](https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#article-source-1) The study supplies no count of completed gift-card purchases, redeemed codes, identified issuer brands or total victim losses. It also does not give the engagement sample size or fieldwork dates needed to generalise the payment split. The documented risk is the conversion of a claimed employment obligation into a demand for transferable value; September marks its research disclosure, rather than the first appearance of the fraud model. [\[1\]](https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#article-source-1) ## In this article ### Companies * [Proofpoint](https://giftcard.news/company/proofpoint/) ### Sources and documents * [Original September28 university fraud research and direct engagements](https://www.proofpoint.com/us/blog/threat-insight/edu-account-takeover-job-scam-abuse-west-african-fraud-actors-target?utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news) — Proofpoint Share [ ](https://x.com/intent/post?url=https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fproofpoint-university-job-scam-gift-card-cashout-research%2F%3Futm%5Fsource%3Dx%26utm%5Fmedium%3Dsocial&text=Proofpoint+links+university+job+scams+to+small-denomination+gift-card+demands&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "X") [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fproofpoint-university-job-scam-gift-card-cashout-research%2F%3Futm%5Fsource%3Dlinkedin%26utm%5Fmedium%3Dsocial&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "LinkedIn") [ ](https://wa.me/?text=Proofpoint+links+university+job+scams+to+small-denomination+gift-card+demands+https%3A%2F%2Fgiftcard.news%2Ffraud-security%2Fproofpoint-university-job-scam-gift-card-cashout-research%2F%3Futm%5Fsource%3Dwhatsapp%26utm%5Fmedium%3Dsocial&utm%5Fsource=giftcard.news&utm%5Fcampaign=giftcard.news "WhatsApp") ![Portrait of Daniel Brooks](https://giftcard.news/images/variants/v1/daniel-brooks-editorial-portrait-w320.webp) About the author ## [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) Journalist — Payments, Security & PCI DSS Daniel Brooks covers payment networks, financial technology, payment security, gift card fraud and PCI DSS for Gift Card News. From reading to building ## Your next move in gift cards. Tell us what you’re building. We’ll help you explore suitable providers. [Find a provider ](https://giftcard.news/find-a-provider/) ## Related articles [Fraud & Security](https://giftcard.news/fraud-security/) News ### [giftee Group estimates JPY 550 million loss after unauthorized e-gift issuance](https://giftcard.news/fraud-security/giftee-unauthorized-egift-issuance-estimated-loss-2026/) [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) October 26, 2026 3 min [Fraud & Security](https://giftcard.news/fraud-security/) News ### [San Francisco settlement creates $1.525 million Vanilla gift-card fund](https://giftcard.news/fraud-security/san-francisco-vanilla-gift-card-restitution-fund/) [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) October 23, 2026 4 min [Fraud & Security](https://giftcard.news/fraud-security/) News ### [Valuedesign reports card-data leak as MOS resets PINs](https://giftcard.news/fraud-security/valuedesign-value-card-data-leak-mos-card-2026/) [Daniel Brooks](https://giftcard.news/author/daniel-brooks/) October 23, 2026 4 min ```json {"@context":"https://schema.org","@graph":[{"@type":"NewsMediaOrganization","@id":"https://giftcard.news/#publisher","name":"Gift Card News","url":"https://giftcard.news/","description":"News and analysis covering gift cards, retail, loyalty, rewards and payments worldwide.","logo":{"@type":"ImageObject","url":"https://giftcard.news/icon-512.png","contentUrl":"https://giftcard.news/icon-512.png","width":512,"height":512,"@id":"https://giftcard.news/#logo"},"publishingPrinciples":"https://giftcard.news/editorial-policy/","correctionsPolicy":"https://giftcard.news/editorial-policy/"},{"@type":"WebSite","@id":"https://giftcard.news/#website","url":"https://giftcard.news/","name":"Gift Card News","description":"News and analysis covering gift cards, retail, loyalty, rewards and payments worldwide.","inLanguage":"en","publisher":{"@id":"https://giftcard.news/#publisher"},"potentialAction":{"@type":"SearchAction","target":"https://giftcard.news/search/?q={search_term_string}","query-input":"required name=search_term_string"}},{"@type":"Person","@id":"https://giftcard.news/author/daniel-brooks/#person","name":"Daniel Brooks","url":"https://giftcard.news/author/daniel-brooks/","description":"Daniel Brooks covers payment networks, financial technology, payment security, gift card fraud and PCI DSS for Gift Card News.","jobTitle":"Journalist — Payments, Security & PCI DSS","image":{"@type":"ImageObject","url":"https://giftcard.news/images/daniel-brooks-editorial-portrait.webp","contentUrl":"https://giftcard.news/images/daniel-brooks-editorial-portrait.webp","width":1254,"height":1254,"caption":"Illustrated portrait representing the Daniel Brooks editorial profile.","@id":"https://giftcard.news/images/daniel-brooks-editorial-portrait.webp#image","encodingFormat":"image/webp","description":"Illustrated portrait for Daniel Brooks, a Gift Card News editorial pen name","creditText":"Gift Card News / AI-generated illustration"}},{"@type":"ImageObject","url":"https://giftcard.news/images/proofpoint-links-university-job-scams-small-denomination-gift-card-demands-customer-hands.webp","contentUrl":"https://giftcard.news/images/proofpoint-links-university-job-scams-small-denomination-gift-card-demands-customer-hands.webp","width":1920,"height":1440,"caption":"Illustrative retail checkout photograph. It does not depict a participant in Proofpoint’s research or a gift-card purchase associated with the reported scams.","@id":"https://giftcard.news/images/proofpoint-links-university-job-scams-small-denomination-gift-card-demands-customer-hands.webp#image","encodingFormat":"image/webp","description":"Customer hands holding a blue card at a retail payment terminal","creditText":"SpotOn / Unsplash","isBasedOn":"https://unsplash.com/photos/customers-interacting-with-a-cashier-and-a-point-of-sale-system-u1DVI-1UUV8"},{"@type":"Dataset","@id":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#dataset","url":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/","name":"Proofpoint links university job scams to small-denomination gift-card demands: figure data","description":"Tabular data for the figures accompanying \"Proofpoint links university job scams to small-denomination gift-card demands\". Sources, units and limitations are documented with each figure.","inLanguage":"en","isPartOf":{"@id":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#article"},"isAccessibleForFree":false,"hasPart":[{"@id":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#article-figure-1-dataset"}],"distribution":{"@type":"DataDownload","contentUrl":"https://giftcard.news/download.csv?article=%2Ffraud-security%2Fproofpoint-university-job-scam-gift-card-cashout-research%2F","encodingFormat":"text/csv","isAccessibleForFree":false}},{"@type":"Dataset","@id":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#article-figure-1-dataset","url":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#article-figure-1","name":"A payment split proposed in one captured scam email","description":"Tabular values displayed in the figure \"A payment split proposed in one captured scam email\" and its accompanying data table.\n\nAmounts explicitly requested in the message reproduced as Figure 13 of Proofpoint’s September 28, 2026 research.\n\nOne observed adversary proposal, not completed transfers, victim losses or a representative average. The message does not specify the payment method for this particular split. Its amounts must not be presented as gift-card denominations or combined with the report’s separate approximate cheque average.","inLanguage":"en","isPartOf":{"@id":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#dataset"},"isAccessibleForFree":true,"variableMeasured":[{"@type":"PropertyValue","name":"Amount proposed in that message","unitText":"$"}],"isBasedOn":[{"@type":"CreativeWork","name":"Proofpoint university job-scam research, Figure 13","url":"https://www.proofpoint.com/us/blog/threat-insight/edu-account-takeover-job-scam-abuse-west-african-fraud-actors-target"}]},{"@type":"NewsArticle","@id":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#article","url":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/","headline":"Proofpoint links university job scams to small-denomination gift-card demands","description":"Researchers engaging fraudsters observed fake-check advances followed by requests to buy USD100 gift cards and send back the codes.","datePublished":"2026-09-28T14:15:25.000Z","dateModified":"2026-10-19T16:15:00.129Z","inLanguage":"en","mainEntityOfPage":{"@id":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#webpage"},"isPartOf":{"@id":"https://giftcard.news/#website"},"isAccessibleForFree":false,"hasPart":[{"@type":"WebPageElement","isAccessibleForFree":false,"cssSelector":".reader-restricted"},{"@id":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#dataset"}],"image":[{"@type":"ImageObject","url":"https://giftcard.news/images/proofpoint-links-university-job-scams-small-denomination-gift-card-demands-customer-hands.webp","contentUrl":"https://giftcard.news/images/proofpoint-links-university-job-scams-small-denomination-gift-card-demands-customer-hands.webp","width":1920,"height":1440,"caption":"Illustrative retail checkout photograph. It does not depict a participant in Proofpoint’s research or a gift-card purchase associated with the reported scams.","@id":"https://giftcard.news/images/proofpoint-links-university-job-scams-small-denomination-gift-card-demands-customer-hands.webp#image","encodingFormat":"image/webp","description":"Customer hands holding a blue card at a retail payment terminal","creditText":"SpotOn / Unsplash","isBasedOn":"https://unsplash.com/photos/customers-interacting-with-a-cashier-and-a-point-of-sale-system-u1DVI-1UUV8"}],"articleSection":"Fraud & Security","keywords":["Proofpoint"],"mentions":[{"@type":"Organization","@id":"https://giftcard.news/company/proofpoint/#entity","name":"Proofpoint","url":"https://giftcard.news/company/proofpoint/"}],"wordCount":454,"citation":[{"@type":"CreativeWork","name":"Original September28 university fraud research and direct engagements","url":"https://www.proofpoint.com/us/blog/threat-insight/edu-account-takeover-job-scam-abuse-west-african-fraud-actors-target","publisher":{"@type":"Organization","name":"Proofpoint"}}],"author":[{"@id":"https://giftcard.news/author/daniel-brooks/#person"}],"publisher":{"@id":"https://giftcard.news/#publisher"}},{"@type":"WebPage","@id":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#webpage","url":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/","name":"Proofpoint links university job scams to small-denomination gift-card demands","description":"Researchers engaging fraudsters observed fake-check advances followed by requests to buy USD100 gift cards and send back the codes.","datePublished":"2026-09-28T14:15:25.000Z","dateModified":"2026-10-19T16:15:00.129Z","inLanguage":"en","isPartOf":{"@id":"https://giftcard.news/#website"},"mainEntity":{"@id":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#article"},"breadcrumb":{"@id":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#breadcrumbs"},"primaryImageOfPage":{"@id":"https://giftcard.news/images/proofpoint-links-university-job-scams-small-denomination-gift-card-demands-customer-hands.webp#image"}},{"@type":"BreadcrumbList","@id":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/#breadcrumbs","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://giftcard.news/"},{"@type":"ListItem","position":2,"name":"Fraud & Security","item":"https://giftcard.news/fraud-security/"},{"@type":"ListItem","position":3,"name":"Proofpoint links university job scams to small-denomination gift-card demands","item":"https://giftcard.news/fraud-security/proofpoint-university-job-scam-gift-card-cashout-research/"}]}]} ```