I have warned about this scam multiple times before. The "Online Fraud" module of the Security Awareness course also specifically warns against this scenario right at the start. Link to the course: Course: EN: Security awareness from secaware.nrw | Lernplattform Bauhaus-Universität Weimar

What is this about? The name of a senior figure at Bauhaus-Universität—usually a professor or someone in a leadership role—is misused as the email sender (email spoofing) to contact students or staff (CEO fraud). These fabricated emails are always very vague; they are designed to create a sense of urgency and trick recipients into taking actions that harm them while providing the attacker with a financial gain.

There is little that can be done to prevent this specific type of fraud, as email was, is, and remains an insecure means of communication. The sender's name and email address can easily be faked without compromising an actual email account. With free email providers, the sender's name can be chosen at will, with no verification of legitimacy or identity. Information about potential victims is easily found online—for instance, on our own website.

The goal of this abuse is to gain the victim's trust and fraudulently obtain gift cards. If the gift cards are actually purchased and the details transmitted, the money is (presumably) lost forever. There is nothing we can do to help those affected, and it is highly questionable whether law enforcement agencies can assist.

As a rule, phishing and other fake emails are designed to create a sense of urgency. Therefore, if you receive an email that pressures you to act quickly, you should exercise extreme vigilance and do the exact opposite: act calmly and deliberately.

The best protection is to stay informed, think things through, and react calmly.

Such emails should not be responded to; they should be deleted.

Indicators of current fake emails:

• Sender's email address
  • Not a Bauhaus-Universität email address
  • Russian sender address
  • Odd naming convention that a legitimate sender would be unlikely to use
• Email content
  • Completely missing. Sending an email with only a subject line and no body text is extremely poor practice.
• Subject line
  • Vague/indefinite
  • Why be so secretive? One could simply state—or at least broadly hint at—what the matter concerns.
• Timing
  • Recipients are contacted on the weekend (Saturday midday).
• Pressure and urgency
  • Creating a sense of urgency is a classic sign of a fake email.
• Issue (e.g., purchasing vouchers; the trap becomes apparent if one mistakenly responds to the emails.)
  • If superiors or professors wish to access funds belonging to their subordinates—even on a temporary basis—it would be problematic from the perspectives of compliance, leadership principles, and labor law. As a general rule, employees are under no obligation to pay for work-related expenses out of their own pockets. Recipients are always free to decline.

-----Fake email [anonymized retrospectively]-----
From: Prof. Dr. Firstname Lastname (pd914571@yandex.ru)
Sent: Saturday, June 20, 2026 13:15
Subject: Please get back to me as soon as you can and let me know your availability.

----- Fake email [anonymized retrospectively]-----
From: Firstname Lastname <prof.head@internet.ru>
Sent: Saturday, June 20, 2026 13:59
Subject:  Are you on campus right now? I have something I'd like to ask you.