What can someone gain from basic personal data?

Question

I've recently received a series of weird emails which I believe to be phishing attempts, the only thing is, I'm not quite sure what they're going for and I'd really love to figure it out.

The emails are sent from a babysitting site run by our school which I am a part of, I've asked friends and the emails seem to be going to most students with accounts on the site, not just me. The sender asks for babysitting for their child, then if you follow up, the send a super long email written in poor English with random details about the family and kids always including this bit:

I will also instruct our estate agent to mail the keys of the apartment to you so as to do all other necessary preparations before we arrive.The following information would be needed to make out the check to you and to get an head start

Full Name: Full address with zip-code & Apt Number: Age: Gender: Phone number: Acceptance of offer: What time you would be available during selected days: Do you have any special attitude? Do you have any crime records?

I've received two sets of these messages so far, in each, the names and family details are changed but everything else remains identical. Additionally, the sender always claims to be some executive assistant at one of our grad schools but uses the name of an undergraduate student, even faking their email address to look like it comes from our school (something like [email protected])

I know they're trying to get something, but I can't figure out what they might gain with just your name address and phone number?

On another note, I've reported these emails to my school but they really haven't taken any action, all they've said is to ignore the emails. It seems like there's a bit of a security breach here though if this person is able to make an account on the babysitting site (you need a school ID or other official login to get on) and is also stealing the names of undergrad students (admittedly less difficult but still weird).

Shouldn't there be a way for the school to track the user and see how they first created their account and gained access to the system and prevent future attempts? At least they could send out a warning email to the students with accounts on the babysitting site right?

Answer 1

TL;DR: this email is probably just the beginning of the scam.

Like marijuana, it could be a gateway email. The thought here being that if you are stupid enough to respond to this initial ruse, they will follow-up with another claiming to need some additional info like bank account to wire money into, the initial email gives them enough pieces to research your full name, DOB, maybe even last 4 of SSN, etc with a tool like Intellius (for extracting money later).

Not sure what the school can/will do about it. In reality, it's probably an international IP and the laws won't really allow for any prosecution -assuming they are using their real name and real account to register the email server in the first place ;)

Agreed that the school should send a warning about the scam, but that's just IMHO.