Re: [Recipient Name]
This phish typically originates from a non-Cornell address. The sender may appear as "[Spoofed Name] <[user]@gmail.com>" and impersonates an employee. Do not reply to the sender. The scammer's goal is a fraudulent financial transfer via personal payment tools such as Zelle.
[Recipient Name], I am currently out of office with limited phone accessibility. Will you be able to handle an Operating Expense on our behalf?
[Name] is unavailable to get it done now, Let me know if you can pay for it through Zelle so I can send you the vendor's Zelle information. I will have your reimbursement processed once the treasurer is available.
Kind Regards,
[Spoofed Name]