Security advisory
Scammers are targeting Solano Community College District faculty with fake tutoring requests. The sender poses as a parent looking for a private tutor for their child and, after several friendly emails, asks for banking details so they can send payment.
Action required: Do not share banking information, deposit an emailed check, or send money. Report suspicious messages to helpdesk@solano.edu.
Advisory details
| Article type |
Security Advisory |
| Audience |
Faculty |
| Severity |
Moderate |
| Status |
Active |
| Last updated |
November 10, 2026 |
Summary
Scammers are sending unsolicited messages to faculty email accounts asking for private tutoring for a child. After several friendly exchanges, often moving to a personal email account, the sender asks for the faculty member's bank name and the name on their account so they can send a "digital check" for mobile deposit. The check is counterfeit, and the sender may later ask the faculty member to return part of the payment or forward money to someone else.
Technology Services and Support (TSS) recently received a report of this scam from a faculty member. It uses the same counterfeit check method described in the September 3, 2026, advisory, Security advisory: Fake job offers and fraudulent checks targeting students.
Who is affected?
Faculty who receive unsolicited requests to privately tutor a student, through their District or personal email accounts, may be targeted. The scam may also target staff whose subject area or contact information is listed on College websites.
If you have not received or responded to one of these messages, no action is required beyond remaining alert.
What you need to do
If you receive one of these messages:
- Do not reply to the message or click its links.
- Do not share your bank name, the name on your bank account, account numbers, or other financial information.
- Do not print or deposit a check received by email, including a "digital check" sent for mobile deposit, unless you independently verify it with the organization that supposedly issued it.
- Do not send money back to the sender, or to anyone they ask you to pay, for any reason.
- Report the message as described in Reporting concerns, then delete it.
What to watch for
Be alert for:
- An unsolicited request to privately tutor a student, often for a set number of weeks starting right away.
- A first message from one email address followed by replies from a personal account, such as Gmail, sometimes under a different name.
- A story that keeps the parent from meeting you, such as an extended work assignment overseas while the child stays with a relative.
- A request for the name on your bank account and your bank's name so a check can be sent.
- A "digital check" sent by email with instructions to print it or use mobile deposit.
- A request to return an overpayment, or to pay a caregiver, vendor, or other third party, using Zelle, a wire transfer, gift cards, cryptocurrency, or another payment method.
What Technology Services and Support is doing
Technology Services and Support is:
- Reviewing reported messages and identifying related scam activity.
- Monitoring for similar messages targeting faculty accounts.
- Providing guidance to faculty and the campus community.
- Applying available email security protections when malicious senders or indicators are identified.
To protect the investigation and District systems, some technical details may not be publicly available.
Reporting concerns
To report a message, forward it to helpdesk@solano.edu and include:
- The sender address. If the conversation moved to another email address, include both addresses.
- The subject and the time you received it.
- A screenshot or copy of the message.
If you already responded:
- Stop interacting with the sender.
- If you shared banking information, deposited a check, or sent money, contact your bank immediately and file a report with the Department of Public Safety (DPS) at (707) 580-6526 or sccdps@solano.edu.
Protect sensitive information: Do not include passwords, multifactor authentication (MFA) verification codes, recovery codes, banking credentials, or other secrets in your help desk tickets.
Figure 1: Screenshot of a fraudulent tutoring request sent to a District faculty member.
A yellow banner at the top warns that the message originated outside the Solano Community College organization and advises recipients not to click links or open attachments unless they know and trust the sender. The sender, signing as a parent, says she and her husband are looking for a tutor for their daughter for about seven weeks. The email asks for the recipient's hourly rate, availability, and subjects, and says the husband will follow up. The sender's name is obscured.
Figure 2: Screenshot of a follow-up message sent from a personal email account.
A yellow banner at the top warns that the message originated outside the Solano Community College organization, along with a notice that the recipient doesn't often get email from this sender. Writing from a personal Gmail account under a different name, the sender says he is a realtor and contractor on a three-month work assignment in Sweden while his 14-year-old daughter stays with a relative in Fairfield, CA. He proposes two sessions a week for seven weeks, accepts the recipient's hourly rate, and asks for the total cost. The sender's name, email address, and phone number are obscured.
Figure 3: Screenshot of a fraudulent email requesting banking information to send a digital check.
A yellow banner at the top warns that the message originated outside the Solano Community College organization. The sender agrees to the total cost, which is written with a typo, and offers to pay half, $1,750, upfront. Saying he is away on a work trip, he offers to send a "digital check" for mobile deposit and asks the recipient to reply with the name on their bank account and the name of their bank. The sender's name is obscured.