A scam that targeted thousands of nonprofits and schools across the U.S. hit Sacramento area schools last week. If you received an email with a Google document to download and did, change your passwords immediately.
Dry Creek Joint Elementary School District staff and parents received the email with the malicious Google document and it is targets like these that make the scam extremely successful.
"There's a different kind of trust in environments there. By doing it that way you see an email from somebody you trust," explains Doug Fodeman with thedailyscam.com.
He says when you see an email from your school, you are on alert and ready to download, but never open an attachment blindly.
"Unfortunately people hide behind so many of the things about the way the internet is designed that will protect criminals. So if you look up who owns these domains, you'll never find it because it turns out they registered them through a proxy service in Panama," says Fodeman.
He says the scam is also incredibly sophisticated.
"When you look at what came up in the mouse over, it pointed to Google. So this link was actually sending you first to Google, but then redirecting you to Google look-a-like sites."
You get a Google doc link to download. It says in essence click here, there is a document waiting for you, please enter your name and password to view it.
"You are logging into another domain and they [cyber criminals] steal your log in credentials. You risk infecting your computer. They would also grab all your contacts and send out the same scam to all of your contacts." You then become the trusted source.
He also adds that the criminal has more protection than you.
"There's not a thing we can do to knock on the door of that service from Panama and say, 'Tell us who really registered those domains.'"
The only way to protect yourself is not to click. Fodeman says change your passwords if you opened any documents and check your device for malware.
Find the most current information on the Google Docs scam here starting Wednesday, May 10th.