Office of Inspector General

Podcast: Phishing at the EPA

September 29, 2017

Al Bailey, a special agent in the EPA OIG's Office of Investigations, discusses a phishing scam at the EPA.

More Podcasts: Listen to our staff talk about their latest audit reports, investigative functions and other initiatives.

Image Gallery: Images associated with podcast (click to enlarge)

This image shows some of the 1,700 EPA emails gathered from the internet by the “phishers.” The EPA is an “open” federal agency, which means a lot of its contact information is readily available and found online.

This file shows the actual email sent by the “phishers” to EPA employees. It is believed that the misspellings and other errors found in these types of “phishing” emails are deliberate techniques to target vulnerable populations.

This file shows the remote log-in page constructed by the “phishers,” which was found on a Mexican newspaper’s website. It looks almost identical to the EPA’s actual log-in page. The “phishers” collected the information that EPA employees entered into this page. Armed with these usernames and passwords, the “phishers” could then access the federal email accounts of those employees and assume their identities.

Gallery Image 4: Captured EPA credentials

This file shows the report that the “phishers” received after the “phished and caught” EPA employees entered their information into the made-up log-in page.

This file shows an actual email between an office supply vendor and the “phishers” using an unwitting EPA employee’s email account.

This file shows an actual invoice for an order of toner placed by the “phishers.” The “phishers” paid for their purchases with credit cards stolen in a separate phishing scam. Note also the valid U.S. address provided for the order. The “phishers” hired unwitting U.S. citizens to serve as shipping intermediaries.

Gallery Image 7: Phishing email sent to personal emails

This file shows a “phishing” email sent to personal email accounts, like Hotmail and Yahoo.

Gallery Image 8: Phishing email sent to bank customers

This file shows a “phishing” email sent targeting USAA Bank account holders, for the purpose of stealing their financial information.

You may need a PDF reader to view some of the files on this page. See EPA’s About PDF page to learn more.

EPA OIG Hotline poster (PDF)(1 pg, 3 MB)

OIG Independence of EPA

The EPA's Office of Inspector General is a part of the EPA, although Congress provides our funding separate from the agency, to ensure our independence. We were created pursuant to the Inspector General Act of 1978, as amended Exit.

Environmental Protection Agency | Office of Inspector General
1200 Pennsylvania Avenue, N.W. (2410T) | Washington, DC 20460 | (202) 566-2391
OIG Hotline: 1-888-546-8740.