30

I received an email from a person that is completely unknown to me, who claims that they were in an online master's program provided by my university department. They are asking for a recommendation letter for an application to a PhD program.

However, I am a postdoc and don't teach any classes. By quickly looking things up, I could not confirm that this person was ever even a student; however, it is in principle possible that they maybe audited some courses or otherwise didn't leave much easily accessible data.

My thoughts are that I should not even respond, because the request is, at best, entirely unreasonable, and at worst, an attempt to commit some kind of academic fraud.

What would be a best practice approach in this case? Would it be more professional to give a negative answer? Should I perhaps report this request to the department?

Improve this question
3
  • 1
    Is it sent from your institution's domain?
    – Azor Ahai -him-
    Commented Nov 29, 2021 at 17:21
  • @AzorAhai-him- From a Yahoo email address.
    – Jake
    Commented Nov 29, 2021 at 17:50
  • 46
    Yeah just delete it, already spent too much mental effort on it haha
    – Azor Ahai -him-
    Commented Nov 29, 2021 at 18:17

3 Answers 3

Reset to default
48

It has become fairly common in the last few years for hackers and spammers to conduct phishing attempts by emailing university staff/faculty and pretending to be students, while asking for letters of reference. I receive mails similar to yours every 2 to 3 months, and just by me doing some Googling on the student's name and info mentioned on the email, it is usually pretty clear that the information on the email is taken from public profiles on the internet.

If you do not know the student, or if the email seems to be somewhat generic (that is, the student's field is only tangentially related to your topic of research, and the student's email shows that they did not bother to do any research about you in advance), then you should do the following:

  • if possible, do not open the emails (check the subject and email preview only)
  • do not click on anything written on the email, do not open or download any attachments whatsoever.
  • immediately mark the email as spam and delete everything inside the spam folder.
Improve this answer
8
  • 31
    You might want to refer the phishing scam to the IT administrator at your school.
    – Ethan Bolker
    Commented Nov 29, 2021 at 17:24
  • 31
    Is there some reason you expect these emails to be more dangerous than the average phishing email, e.g. more likely to take advantage of an exploit triggered by viewing the message to install a virus? If not, I think this answer slightly overstates the risk; in particular, the need to immediately mark the email as spam, and to delete everything inside the spam folder, sounds like overkill.
    – David Z
    Commented Nov 30, 2021 at 1:09
  • 5
    @DavidZ I certainly understand your comment, but there were a couple of departments close to where I work that were working on pretty advanced experiments, and therefore make attractive targets for hacking. Also, a regular visit to sites like securityweek.com can make one very much aware of how relaxing even a little bit in terms of security can be deadly.
    – djohn
    Commented Nov 30, 2021 at 5:13
  • 3
    Just to add that, the above 3 steps are mainly for cookie-cutter, generic attempts that can be identified relatively quickly. If you do get an email that's well-researched, and does appear initially to come from someone you know, but something about the message feels off, then I usually contact the person in question by sms or phone, and if it is indeed a fake email, then it's best to notify the IT department.
    – djohn
    Commented Nov 30, 2021 at 5:35
  • 4
    If you are afraid that the email may be phishing of some sort then sending it to spam is not a good idea. You should contact your IT department and they should investigate the issue. This will make them aware that you/your organization is experiencing some cyberthreats, and they may take some steps to mitigate the risks. Sending the email to spam might not cause harm, but if the threat is real, your organization might remain oblivious to it.
    – Bartors
    Commented Nov 30, 2021 at 9:00
17

It doesn't really matter whether you ignore the request or reply with a negative response. You do not know this person, they may or may not have any actual relation to a course you didn't give. I would just ignore the request.

Improve this answer
12

I would give a negative reply, telling you could not find him. Then he tries harder to reach the right person. Otherwise he might wait for too long, hoping for an answer which is never coming, finally hurting his PhD application.

I think it is impolite and a disservice to your employer not responding with two sentences.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .